Messages in this thread | | | From | Masayoshi Mizuma <> | Subject | [PATCH 0/1] arm64/sve: Fix wrong free for task->thread.sve_state | Date | Thu, 26 Sep 2019 15:08:45 -0400 |
| |
From: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
The system which has SVE feature crashed by unknown reason. According to the memory dump, the panic happened because the memory data pointed by task->thread.sve_state was destroyed by someone.
We tried to reproduce the crash, however, it's hard to do that. But, we found a potential issue by reviewing the code.
In copy_process(), the child process has the pointer of sve_state which is same as the parent's because the child's task_struct is copied from the parent's one. If the copy_process() fails as an error on somewhere, for example, copy_creds(), then the sve_state is freed even if the parent is alive. The flow is as follows.
copy_process p = dup_task_struct => arch_dup_task_struct *dst = *src; // copy the entire region. : retval = copy_creds if (retval < 0) goto bad_fork_free; : bad_fork_free: ... delayed_free_task(p); => free_task => arch_release_task_struct => fpsimd_release_task => __sve_free => kfree(task->thread.sve_state); // free the parent's sve_state
To fix that, add a flag in task->thread which shows the fork is in progress. If the fork is in progress, that means the child has the pointer to the parent's sve_state, doesn't free the sve_state.
Masayoshi Mizuma (1): arm64/sve: Fix wrong free for task->thread.sve_state
arch/arm64/include/asm/processor.h | 1 + arch/arm64/kernel/fpsimd.c | 6 ++++-- arch/arm64/kernel/process.c | 2 ++ 3 files changed, 7 insertions(+), 2 deletions(-)
-- 2.18.1
| |