DMA heap: release reserved fd and buffer when returning the allocation fails #69

DMA_HEAP_IOCTL_ALLOC installs the allocated dma-buf fd before copying the result to userspace. If that final copy fails, the ioctl returns EFAULT but leaves the fd and buffer reference in the calling process. PR #67 makes the existing heap interface available in the Aurora configuration.

Priority: P3 · Readiness: released · Owner: kernel

Affected source: dma-heap.c at 646ade7, dma_heap_buffer_alloc() / dma_heap_ioctl().

Reproducer: With access to /dev/dma_heap/system, prepare a page-sized allocation request in a readable/writable mapping, then make the request mapping read-only before calling the ioctl. copy_from_user() can read the request; copy_to_user() cannot write the returned fd. Compare the process’s open descriptors before and after EFAULT. No physical GPU is needed. This is a caller-owned resource leak, not an established privilege escalation.

Candidate: upstream 30d0aff, by Baineng Shou. Reserve the fd, perform the copy, release the reservation/buffer on failure, and publish only after success. Do not close an already published fd on failure: another thread can duplicate or reuse it.

Acceptance: Test successful publication, invalid flags/zero or overflowing sizes, allocation/fd-reservation failures, final-copy failure and concurrent observation of the fd. The failure path must publish no fd and retain no buffer reference. Keep the UAPI and existing dma-buf export callers unchanged; compile the affected ARM64 objects and independently review the port. Actual kernel ioctl execution remains separate from source-controlled tests.

Roadmap: #56. Separate from the configuration-only #67: .14 includes the source cleanup but leaves DMA heaps disabled in the release configuration. No live heap-ioctl test is claimed.

Current status: Closed after merging #70. DMA heap allocation now copies the result before publishing the fd. Failed copies release the reserved fd and buffer. The 54 production-path controls, 12 negative controls and focused ARM64 builds pass. Delivered in Aurora 2026.10.11.14. The published installer and package checks pass.