DF-4362 / fix.diff
diff --git a/sys/dev/drm/drm_atomic_uapi.c b/sys/dev/drm/drm_atomic_uapi.c index 1111111..2222222 100644 --- a/sys/dev/drm/drm_atomic_uapi.c +++ b/sys/dev/drm/drm_atomic_uapi.c @@ -457,14 +457,21 @@ static int drm_atomic_crtc_set_property(struct drm_crtc *crtc, &state->gamma_lut, val, -1, sizeof(struct drm_color_lut), &replaced); state->color_mgmt_changed |= replaced; return ret; } else if (property == config->prop_out_fence_ptr) { s32 __user *fence_ptr = u64_to_user_ptr(val); if (!fence_ptr) return 0; - if (put_user(-1, fence_ptr)) - return -EFAULT; - - set_out_fence_for_crtc(state->state, crtc, fence_ptr); + /* + * DF TODO: sync_file_create() is a NULL-returning stub and + * fd_install()/fput()/put_unused_fd() are no-op stubs + * (include/linux/{sync_file,file}.h), while + * get_unused_fd_flags() really allocates a struct file via + * falloc(). Any commit that reaches prepare_signaling() + * with an out-fence therefore permanently leaks one struct + * file (nfiles never recovers; system-wide ENFILE once + * kern.maxfiles is exhausted) and spams the console. + * Refuse the request until real sync_file support lands. + * (DF-4362) + */ + return -EOPNOTSUPP; } else if (crtc->funcs->atomic_set_property) { return crtc->funcs->atomic_set_property(crtc, state, property, val); } else { @@ -735,9 +742,14 @@ static int drm_atomic_connector_set_property(struct drm_connector *connector, } else if (property == config->writeback_out_fence_ptr_property) { s32 __user *fence_ptr = u64_to_user_ptr(val); - return set_out_fence_for_connector(state->state, connector, - fence_ptr); + /* + * DF TODO: same as prop_out_fence_ptr above -- the writeback + * out-fence path also funnels into setup_out_fence() and + * would leak a struct file per commit. (DF-4362) + */ + if (fence_ptr) + return -EOPNOTSUPP; + return 0; } else if (connector->funcs->atomic_set_property) { return connector->funcs->atomic_set_property(connector, state, property, val); |