⬢ DragonFlyBSD Kernel Audit
DF-4362 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/drm_atomic_uapi.c b/sys/dev/drm/drm_atomic_uapi.c
index 1111111..2222222 100644
--- a/sys/dev/drm/drm_atomic_uapi.c
+++ b/sys/dev/drm/drm_atomic_uapi.c
@@ -457,14 +457,21 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
 					&state->gamma_lut,
 					val,
 					-1, sizeof(struct drm_color_lut),
 					&replaced);
 		state->color_mgmt_changed |= replaced;
 		return ret;
 	} else if (property == config->prop_out_fence_ptr) {
 		s32 __user *fence_ptr = u64_to_user_ptr(val);
 
 		if (!fence_ptr)
 			return 0;
 
-		if (put_user(-1, fence_ptr))
-			return -EFAULT;
-
-		set_out_fence_for_crtc(state->state, crtc, fence_ptr);
+		/*
+		 * DF TODO: sync_file_create() is a NULL-returning stub and
+		 * fd_install()/fput()/put_unused_fd() are no-op stubs
+		 * (include/linux/{sync_file,file}.h), while
+		 * get_unused_fd_flags() really allocates a struct file via
+		 * falloc().  Any commit that reaches prepare_signaling()
+		 * with an out-fence therefore permanently leaks one struct
+		 * file (nfiles never recovers; system-wide ENFILE once
+		 * kern.maxfiles is exhausted) and spams the console.
+		 * Refuse the request until real sync_file support lands.
+		 * (DF-4362)
+		 */
+		return -EOPNOTSUPP;
 	} else if (crtc->funcs->atomic_set_property) {
 		return crtc->funcs->atomic_set_property(crtc, state, property, val);
 	} else {
@@ -735,9 +742,14 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector,
 	} else if (property == config->writeback_out_fence_ptr_property) {
 		s32 __user *fence_ptr = u64_to_user_ptr(val);
 
-		return set_out_fence_for_connector(state->state, connector,
-						   fence_ptr);
+		/*
+		 * DF TODO: same as prop_out_fence_ptr above -- the writeback
+		 * out-fence path also funnels into setup_out_fence() and
+		 * would leak a struct file per commit.  (DF-4362)
+		 */
+		if (fence_ptr)
+			return -EOPNOTSUPP;
+		return 0;
 	} else if (connector->funcs->atomic_set_property) {
 		return connector->funcs->atomic_set_property(connector,
 				state, property, val);