Patch "udmabuf: fix memory leak on last export_udmabuf() error path" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    udmabuf: fix memory leak on last export_udmabuf() error path

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     udmabuf-fix-memory-leak-on-last-export_udmabuf-error.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 56ebc1b3fb2199fad2a698b4af71614f111e5c1a
Author: Jann Horn <jannh@xxxxxxxxxx>
Date:   Wed Dec 4 17:26:21 2024 +0100

    udmabuf: fix memory leak on last export_udmabuf() error path
    
    [ Upstream commit f49856f525acd5bef52ae28b7da2e001bbe7439e ]
    
    In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a
    dma_buf owning the udmabuf has already been created; but the error handling
    in udmabuf_create() will tear down the udmabuf without doing anything about
    the containing dma_buf.
    
    This leaves a dma_buf in memory that contains a dangling pointer; though
    that doesn't seem to lead to anything bad except a memory leak.
    
    Fix it by moving the dma_buf_fd() call out of export_udmabuf() so that we
    can give it different error handling.
    
    Note that the shape of this code changed a lot in commit 5e72b2b41a21
    ("udmabuf: convert udmabuf driver to use folios"); but the memory leak
    seems to have existed since the introduction of udmabuf.
    
    Fixes: fbb0de795078 ("Add udmabuf misc device")
    Acked-by: Vivek Kasireddy <vivek.kasireddy@xxxxxxxxx>
    Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
    Signed-off-by: Vivek Kasireddy <vivek.kasireddy@xxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20241204-udmabuf-fixes-v2-3-23887289de1c@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 970e08a95dc0..614df433c451 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -276,12 +276,10 @@ static int check_memfd_seals(struct file *memfd)
 	return 0;
 }
 
-static int export_udmabuf(struct udmabuf *ubuf,
-			  struct miscdevice *device,
-			  u32 flags)
+static struct dma_buf *export_udmabuf(struct udmabuf *ubuf,
+				      struct miscdevice *device)
 {
 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
-	struct dma_buf *buf;
 
 	ubuf->device = device;
 	exp_info.ops  = &udmabuf_ops;
@@ -289,11 +287,7 @@ static int export_udmabuf(struct udmabuf *ubuf,
 	exp_info.priv = ubuf;
 	exp_info.flags = O_RDWR;
 
-	buf = dma_buf_export(&exp_info);
-	if (IS_ERR(buf))
-		return PTR_ERR(buf);
-
-	return dma_buf_fd(buf, flags);
+	return dma_buf_export(&exp_info);
 }
 
 static long udmabuf_pin_folios(struct udmabuf *ubuf, struct file *memfd,
@@ -356,6 +350,7 @@ static long udmabuf_create(struct miscdevice *device,
 {
 	pgoff_t pgcnt = 0, pglimit;
 	struct udmabuf *ubuf;
+	struct dma_buf *dmabuf;
 	long ret = -EINVAL;
 	u32 i, flags;
 
@@ -413,9 +408,20 @@ static long udmabuf_create(struct miscdevice *device,
 	}
 
 	flags = head->flags & UDMABUF_FLAGS_CLOEXEC ? O_CLOEXEC : 0;
-	ret = export_udmabuf(ubuf, device, flags);
-	if (ret < 0)
+	dmabuf = export_udmabuf(ubuf, device);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
 		goto err;
+	}
+	/*
+	 * Ownership of ubuf is held by the dmabuf from here.
+	 * If the following dma_buf_fd() fails, dma_buf_put() cleans up both the
+	 * dmabuf and the ubuf (through udmabuf_ops.release).
+	 */
+
+	ret = dma_buf_fd(dmabuf, flags);
+	if (ret < 0)
+		dma_buf_put(dmabuf);
 
 	return ret;