Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Bypassing the standard dma_buf_fd() API skips the emission of the trace_dma_buf_fd tracepoint. --
--- Patch [1]: [PATCH v2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds --- commit 869904722955c74d0c6e8c974d3c64c6befabac6 Author: Baineng Shou <[email protected]> dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds This commit restructures DMA_HEAP_IOCTL_ALLOC to delay publishing the file descriptor until after copy_to_user() succeeds. It open-codes the fd allocation and installation steps instead of using dma_buf_fd() to prevent an fd leak on copy_to_user() failure. Link: https://lore.kernel.org/dri-devel/[email protected]/ > diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c > index 3937dd41bb0f6..983dee947c851 100644 > --- a/drivers/dma-buf/dma-heap.c > +++ b/drivers/dma-buf/dma-heap.c [ ... ] > @@ -175,15 +162,28 @@ static long dma_heap_ioctl(struct file *file, unsigned > int ucmd, > > switch (kcmd) { > case DMA_HEAP_IOCTL_ALLOC: > - ret = dma_heap_ioctl_allocate(file, kdata); > + dmabuf = dma_heap_ioctl_allocate(file, kdata); > + > + if (IS_ERR(dmabuf)) { > + ret = PTR_ERR(dmabuf); > + break; > + } > + > + fd = ((struct dma_heap_allocation_data *)kdata)->fd; > + if (copy_to_user((void __user *)arg, kdata, out_size) != 0) { > + put_unused_fd(fd); > + dma_buf_put(dmabuf); > + ret = -EFAULT; > + } else { > + fd_install(fd, dmabuf->file); [Severity: Medium] By open-coding the fd reservation and installation here instead of using dma_buf_fd(), does this skip the emission of the trace_dma_buf_fd tracepoint? If so, observability tools, BPF scripts, and perf tracing relying on trace_dma_buf_fd to map dmabufs to file descriptors will silently miss all allocations originating from the dma-heap subsystem. > + } > + > break; > default: > ret = -ENOTTY; > goto err; > } -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
