The selftest helper reads the new dmabuf fd from the ioctl return
value:

	*out_fd = ioctl(fd, IOMMU_TEST_CMD, &cmd);

Commit dba4254e216d ("iommufd/selftest: Fix dmabuf leak in
iommufd_test_dmabuf_get()") fixed the dmabuf leak on dma_buf_fd()
failure, but the applied version also changed the success path to
return 0, so userspace no longer receives the fd.  Note the patch as
posted on the list returned rc here; the change to return 0 appeared
when it was applied:

  https://lore.kernel.org/all/20260707030635.221577-1-seven.yi.lee@gmail.com/

Every test using test_cmd_get_dmabuf() then operates on fd 0 instead
of the dmabuf, and the dmabuf_simple and dmabuf_revoke selftests fail
across all fixtures:

  # iommufd.c:1595:dmabuf_simple:Expected -1 (-1) ==
    _test_ioctl_ioas_map_file(...) (0)

Keep the dma_buf_put() on failure but return the fd on success.

Fixes: dba4254e216d ("iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()")
Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
---
 drivers/iommu/iommufd/selftest.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index ee706f18f7e91..f6da927461b57 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -2056,11 +2056,9 @@ static int iommufd_test_dmabuf_get(struct iommufd_ucmd *ucmd,
 	}
 
 	rc = dma_buf_fd(dmabuf, open_flags);
-	if (rc < 0) {
+	if (rc < 0)
 		dma_buf_put(dmabuf);
-		return rc;
-	}
-	return 0;
+	return rc;
 
 err_free:
 	kfree(priv->memory);
-- 
2.43.7

On Wed, 02 Sep 2026 16:54:14 +0800, Qinyun Tan wrote:
> iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

Applied, thanks!

[1/1] iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again
      commit: 1d56f4d6db3d2b2c93017a80c4f9c4cfffa9d193

Best regards,
-- 
Jason

On Wed, Sep 02, 2026 at 04:54:14PM +0800, Qinyun Tan wrote:
> The selftest helper reads the new dmabuf fd from the ioctl return
> value:
> 
> 	*out_fd = ioctl(fd, IOMMU_TEST_CMD, &cmd);
> 
> Commit dba4254e216d ("iommufd/selftest: Fix dmabuf leak in
> iommufd_test_dmabuf_get()") fixed the dmabuf leak on dma_buf_fd()
> failure, but the applied version also changed the success path to
> return 0, so userspace no longer receives the fd.  Note the patch as
> posted on the list returned rc here; the change to return 0 appeared
> when it was applied:
> 
>   https://lore.kernel.org/all/20260707030635.221577-1-seven.yi.lee@gmail.com/
> 
> Every test using test_cmd_get_dmabuf() then operates on fd 0 instead
> of the dmabuf, and the dmabuf_simple and dmabuf_revoke selftests fail
> across all fixtures:
> 
>   # iommufd.c:1595:dmabuf_simple:Expected -1 (-1) ==
>     _test_ioctl_ioas_map_file(...) (0)
> 
> Keep the dma_buf_put() on failure but return the fd on success.
> 
> Fixes: dba4254e216d ("iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()")
> Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
> ---
>  drivers/iommu/iommufd/selftest.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
> index ee706f18f7e91..f6da927461b57 100644
> --- a/drivers/iommu/iommufd/selftest.c
> +++ b/drivers/iommu/iommufd/selftest.c
> @@ -2056,11 +2056,9 @@ static int iommufd_test_dmabuf_get(struct iommufd_ucmd *ucmd,
>  	}
>  
>  	rc = dma_buf_fd(dmabuf, open_flags);
> -	if (rc < 0) {
> +	if (rc < 0)
>  		dma_buf_put(dmabuf);
> -		return rc;
> -	}
> -	return 0;
> +	return rc;
>  
>  err_free:
>  	kfree(priv->memory);
> -- 
> 2.43.7
> 

Applied on upstream v7.3-rc1 kernel, issue was resolved.

Tested-by: Yi Lai <yi1.lai@intel.com>

> failure, but the applied version also changed the success path to
> return 0, so userspace no longer receives the fd.  Note the patch as
> posted on the list returned rc here; the change to return 0 appeared
> when it was applied:

Thanks for catching it.