https://bugs.kde.org/show_bug.cgi?id=527637
Bug ID: 527637
Summary: kwin_wayland leaks memfd file descriptors on
wl_shm_pool destruction and fails udmabuf creation on
non-page-aligned buffers
Classification: Plasma
Product: kwin
Version First 6.8.1
Reported In:
Platform: Gentoo Packages
OS: Linux
Status: REPORTED
Severity: minor
Priority: NOR
Component: wayland-generic
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 197536
--> https://bugs.kde.org/attachment.cgi?id=197536&action=edit
Fix memfd leak in ShmPool and gpumanager udmabuf
Operating System: Gentoo Linux
KDE Plasma Version: 6.8.1
KDE Frameworks Version: 6.30.0
Qt Version: 6.11.2
Graphics Platform: Wayland / amdgpu
Observed Behavior:
Over prolonged sessions, kwin_wayland accumulates thousands of open, unlinked
memfd file descriptors "/memfd:gdk-wayland (deleted)", consuming gigabytes of
shared memory.
Root Cause:
1. In src/wayland/shmclientbuffer.cpp, ShmPool::shm_pool_destroy_resource()
calls unref(), but because existing ShmClientBuffer instances hold a reference
to the pool, the ShmPool object is not deleted and its file descriptor (fd)
remains open in kwin's process table. Per the Wayland specification, a
destroyed pool cannot be resized or used to create buffers anymore; the fd can
and should be closed immediately via fd.reset().
2. In ShmPool::shm_pool_create_buffer(), attributes.fd is duplicated
unconditionally (fd.duplicate()). This duplicated descriptor is only needed
during constructor execution for GpuManager::createUdmabuf().
3. In src/core/gpumanager.cpp, GpuManager::createUdmabuf() aligns the buffer
size to PAGE_SIZE . Because the aligned size exceeds the actual memfd file size
(aka statbuf.st_size), the kernel's drivers/dma-buf/udmabuf.c rejects the ioctl
with -EINVAL. This causes udmabuf creation to fail on GDK buffers whose
dimensions do not align with 4096 bytes, falling back to CPU upload while
leaving the redundant duplicated fd open.
Fix:
- Call fd.reset() inside ShmPool::shm_pool_destroy_resource().
- Drop the redundant duplicated fd in ShmClientBuffer once udmabuf attempt
finishes.
- Add bounds checks (attributes->offset + alignedSize <= statbuf.st_size) in
GpuManager::createUdmabuf() to prevent invalid UDMABUF_CREATE ioctls.
Attached patch resolves the leak and stabilizes fd count on kwin-6.8.1.
--
You are receiving this mail because:
You are watching all bug changes.
