Messages in this thread | | | Date | Mon, 22 May 2023 18:40:59 +0300 | From | Dan Carpenter <> | Subject | Re: arm64: fp-stress: BUG: KFENCE: memory corruption in fpsimd_release_task |
| |
On Thu, May 18, 2023 at 10:52:31AM +0900, Mark Brown wrote: > > When we call sme_alloc() it will say the buffer is already allocated > > and just zero out what we need for "vl", but the existing buffer is too > > small. > > If we are setting the SVE vector length we do not need to reallocate the > SME state since the size of the data stored in the sme_state buffer is > influenced only by the SME vector length, not the SVE vector length. We > unconditionally free the SVE state (causing it to be reallocated when > needed) since the size needed for it depends on both vector lengths.
arch/arm64/kernel/fpsimd.c 909 /* 910 * Force reallocation of task SVE and SME state to the correct 911 * size on next use: 912 */ 913 sve_free(task); ^^^^^^^^^^^^^^ Sure, this forces a reallocation. But what prevents it from happening before we reach the task_set_vl() line?
914 if (system_supports_sme() && type == ARM64_VEC_SME) 915 sme_free(task); 916 917 task_set_vl(task, type, vl); 918 919 out: 920 update_tsk_thread_flag(task, vec_vl_inherit_flag(type), 921 flags & PR_SVE_VL_INHERIT); 922 923 return 0;
regards, dan carpenter
| |