Re: [PATCH] iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

[Lai, Yi]

On Wed, Sep 02, 2026 at 04:54:14PM +0800, Qinyun Tan wrote:
> The selftest helper reads the new dmabuf fd from the ioctl return
> value:
> 
> 	*out_fd = ioctl(fd, IOMMU_TEST_CMD, &cmd);
> 
> Commit dba4254e216d ("iommufd/selftest: Fix dmabuf leak in
> iommufd_test_dmabuf_get()") fixed the dmabuf leak on dma_buf_fd()
> failure, but the applied version also changed the success path to
> return 0, so userspace no longer receives the fd.  Note the patch as
> posted on the list returned rc here; the change to return 0 appeared
> when it was applied:
> 
>   https://lore.kernel.org/all/20260707030635.221577-1-seven.yi.lee@xxxxxxxxx/
> 
> Every test using test_cmd_get_dmabuf() then operates on fd 0 instead
> of the dmabuf, and the dmabuf_simple and dmabuf_revoke selftests fail
> across all fixtures:
> 
>   # iommufd.c:1595:dmabuf_simple:Expected -1 (-1) ==
>     _test_ioctl_ioas_map_file(...) (0)
> 
> Keep the dma_buf_put() on failure but return the fd on success.
> 
> Fixes: dba4254e216d ("iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()")
> Signed-off-by: Qinyun Tan <qinyuntan@xxxxxxxxxxxxxxxxx>
> ---
>  drivers/iommu/iommufd/selftest.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
> index ee706f18f7e91..f6da927461b57 100644
> --- a/drivers/iommu/iommufd/selftest.c
> +++ b/drivers/iommu/iommufd/selftest.c
> @@ -2056,11 +2056,9 @@ static int iommufd_test_dmabuf_get(struct iommufd_ucmd *ucmd,
>  	}
>  
>  	rc = dma_buf_fd(dmabuf, open_flags);
> -	if (rc < 0) {
> +	if (rc < 0)
>  		dma_buf_put(dmabuf);
> -		return rc;
> -	}
> -	return 0;
> +	return rc;
>  
>  err_free:
>  	kfree(priv->memory);
> -- 
> 2.43.7
> 

Applied on upstream v7.3-rc1 kernel, issue was resolved.

Tested-by: Yi Lai <yi1.lai@xxxxxxxxx>