Messages in this thread | | | Date | Tue, 23 May 2023 11:28:14 +0100 | From | Mark Brown <> | Subject | Re: arm64: fp-stress: BUG: KFENCE: memory corruption in fpsimd_release_task |
| |
On Mon, May 22, 2023 at 06:40:59PM +0300, Dan Carpenter wrote: > On Thu, May 18, 2023 at 10:52:31AM +0900, Mark Brown wrote:
> > > When we call sme_alloc() it will say the buffer is already allocated > > > and just zero out what we need for "vl", but the existing buffer is too > > > small.
> > If we are setting the SVE vector length we do not need to reallocate the > > SME state since the size of the data stored in the sme_state buffer is > > influenced only by the SME vector length, not the SVE vector length. We > > unconditionally free the SVE state (causing it to be reallocated when > > needed) since the size needed for it depends on both vector lengths.
> arch/arm64/kernel/fpsimd.c > 909 /* > 910 * Force reallocation of task SVE and SME state to the correct > 911 * size on next use: > 912 */ > 913 sve_free(task);
> Sure, this forces a reallocation. But what prevents it from happening > before we reach the task_set_vl() line?
Reallocation is either triggered by a trap from userspace or via ptrace, as is a vector length configuration. The two cases should already be prevented from running simultaneously, and can't simultaneously perform two actions. [unhandled content-type:application/pgp-signature] | |