diff options
| author | yeeli <seven.yi.lee@gmail.com> | 2026-07-07 11:06:35 +0800 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-07-13 12:42:45 -0300 |
| commit | dba4254e216d7482d91d93e45faa3ccbefe79337 (patch) | |
| tree | 830e064309cb3f37e133b9201270706276861626 | |
| parent | 4132ba2ae2cf14c289e3fabc1c95ac244d643356 (diff) | |
| download | linux-next-dba4254e216d7482d91d93e45faa3ccbefe79337.tar.gz linux-next-dba4254e216d7482d91d93e45faa3ccbefe79337.zip | |
iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()
When dma_buf_export() succeeds but dma_buf_fd() fails (e.g. -EMFILE from
fd exhaustion), the dmabuf is leaked with no dma_buf_put() called.
Reproducer: exhaust fd table near RLIMIT_NOFILE, then repeatedly call
IOMMU_TEST_OP_DMABUF_GET — htop shows unbounded memory growth.
Fix by calling dma_buf_put(dmabuf) on error and returning directly.
Fixes: d2041f1f11dd ("iommufd/selftest: Add some tests for the dmabuf flow")
Link: https://patch.msgid.link/r/20260707030635.221577-1-seven.yi.lee@gmail.com
Signed-off-by: yeeli <seven.yi.lee@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/iommu/iommufd/selftest.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c index 7ee9441c25c3..b021fc6bc5f5 100644 --- a/drivers/iommu/iommufd/selftest.c +++ b/drivers/iommu/iommufd/selftest.c @@ -2026,7 +2026,12 @@ static int iommufd_test_dmabuf_get(struct iommufd_ucmd *ucmd, goto err_free; } - return dma_buf_fd(dmabuf, open_flags); + rc = dma_buf_fd(dmabuf, open_flags); + if (rc < 0) { + dma_buf_put(dmabuf); + return rc; + } + return 0; err_free: kfree(priv->memory); |