Summary

dma_buf_fd() accepts O_CLOEXEC in the flags parameter but the implementation is a stub (#if 0 block). The dma-buf fd is never marked close-on-exec, so it survives execve() even when userspace explicitly requested O_CLOEXEC via DRM_IOCTL_PRIME_HANDLE_TO_FD with DRM_CLOEXEC. A dma-buf fd containing sensitive GPU memory could leak into a child process across exec().

Root cause

linux_dma-buf.c:150-157: the if (flags & O_CLOEXEC) block contains only a comment and dead #if-0 code. fdalloc() at line 159 is called with flags=0, not flags, so UF_EXCLOSE is never set.

Recommended fix

After fdalloc, set UF_EXCLOSE on the descriptor when O_CLOEXEC was requested.

--- a/sys/dev/drm/linux_dma-buf.c
+++ b/sys/dev/drm/linux_dma-buf.c
@@ -147,16 +147,13 @@ int
 dma_buf_fd(struct dma_buf *dmabuf, int flags)
 {
    int fd, error;
+   int oflags = 0;

    if (dmabuf == NULL)
        return -EINVAL;
    if (dmabuf->file == NULL)
        return -EINVAL;

-   if (flags & O_CLOEXEC) {
-   /* XXX: CLOEXEC not handled yet */
-#if 0
-       __set_close_on_exec(fd, fdt);
-   else
-       __clear_close_on_exec(fd, fdt);
-#endif
-   }
+   if (flags & O_CLOEXEC)
+       oflags |= UF_EXCLOSE;

-   error = fdalloc(curproc, 0, &fd);
+   error = fdalloc(curproc, oflags, &fd);

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.