[lkml]   [2019]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/1] arm64/sve: Fix wrong free for task->thread.sve_state
From: Masayoshi Mizuma <>

The system which has SVE feature crashed by unknown
reason. According to the memory dump, the panic happened
because the memory data pointed by task->thread.sve_state was
destroyed by someone.

We tried to reproduce the crash, however, it's hard to do that.
But, we found a potential issue by reviewing the code.

In copy_process(), the child process has the pointer of sve_state
which is same as the parent's because the child's task_struct is
copied from the parent's one. If the copy_process() fails as an
error on somewhere, for example, copy_creds(), then the sve_state
is freed even if the parent is alive. The flow is as follows.

p = dup_task_struct
=> arch_dup_task_struct
*dst = *src; // copy the entire region.
retval = copy_creds
if (retval < 0)
goto bad_fork_free;
=> free_task
=> arch_release_task_struct
=> fpsimd_release_task
=> __sve_free
=> kfree(task->thread.sve_state);
// free the parent's sve_state

To fix that, add a flag in task->thread which shows the fork
is in progress. If the fork is in progress, that means the
child has the pointer to the parent's sve_state, doesn't
free the sve_state.

Masayoshi Mizuma (1):
arm64/sve: Fix wrong free for task->thread.sve_state

arch/arm64/include/asm/processor.h | 1 +
arch/arm64/kernel/fpsimd.c | 6 ++++--
arch/arm64/kernel/process.c | 2 ++
3 files changed, 7 insertions(+), 2 deletions(-)


 \ /
  Last update: 2019-09-26 21:09    [W:0.049 / U:8.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site