linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/1] arm64/sve: Fix wrong free for task->thread.sve_state
@ 2019-09-26 19:08 Masayoshi Mizuma
  2019-09-26 19:08 ` [PATCH 1/1] " Masayoshi Mizuma
  0 siblings, 1 reply; 6+ messages in thread
From: Masayoshi Mizuma @ 2019-09-26 19:08 UTC (permalink / raw)
  To: Catalin Marinas, Will Deacon, linux-arm-kernel
  Cc: Masayoshi Mizuma, Masayoshi Mizuma, linux-kernel

From: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>

The system which has SVE feature crashed by unknown
reason. According to the memory dump, the panic happened
because the memory data pointed by task->thread.sve_state was
destroyed by someone.

We tried to reproduce the crash, however, it's hard to do that.
But, we found a potential issue by reviewing the code.

In copy_process(), the child process has the pointer of sve_state
which is same as the parent's because the child's task_struct is
copied from the parent's one. If the copy_process() fails as an
error on somewhere, for example, copy_creds(), then the sve_state
is freed even if the parent is alive. The flow is as follows.

copy_process
        p = dup_task_struct
            => arch_dup_task_struct
                *dst = *src;  // copy the entire region.
:
        retval = copy_creds
        if (retval < 0)
                goto bad_fork_free;
:
bad_fork_free:
...
        delayed_free_task(p);
        => free_task
           => arch_release_task_struct
              => fpsimd_release_task
                 => __sve_free
                    => kfree(task->thread.sve_state);
                       // free the parent's sve_state

To fix that, add a flag in task->thread which shows the fork
is in progress. If the fork is in progress, that means the
child has the pointer to the parent's sve_state, doesn't
free the sve_state.

Masayoshi Mizuma (1):
  arm64/sve: Fix wrong free for task->thread.sve_state

 arch/arm64/include/asm/processor.h | 1 +
 arch/arm64/kernel/fpsimd.c         | 6 ++++--
 arch/arm64/kernel/process.c        | 2 ++
 3 files changed, 7 insertions(+), 2 deletions(-)

-- 
2.18.1


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2019-09-27 15:06 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-26 19:08 [PATCH 0/1] arm64/sve: Fix wrong free for task->thread.sve_state Masayoshi Mizuma
2019-09-26 19:08 ` [PATCH 1/1] " Masayoshi Mizuma
2019-09-27 11:04   ` Julien Grall
2019-09-27 12:52   ` Dave Martin
2019-09-27 14:38     ` Masayoshi Mizuma
2019-09-27 15:06       ` Dave Martin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).