github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

arm64/gcs: release GCS on failed fork

Browse Source 
copy_thread() can map a CLONE_VM GCS and still return 0. A later
copy_process() failure calls exit_thread(), but arm64 did not
implement it, so the VMA stayed in the parent's mm. Wire
HAVE_EXIT_THREAD to gcs_free().

Kernel threads created with CLONE_VM (io_uring and vhost workers)
inherit the parent's gcs_base/gcs_size from arch_dup_task_struct()
without allocating their own GCS. When such a thread exits,
exit_mm() -> mm_release() -> deactivate_mm() -> gcs_free() unmaps the
parent's GCS. With the new exit_thread(), a failed copy_process() for
one of these threads would do the same. Clear these fields in
copy_thread().

Fixes: 506496bcbb ("arm64/gcs: Ensure that new threads have a GCS")
Cc: stable@vger.kernel.org
Cc: Mark Brown <broonie@kernel.org>
Assisted-by: LLM
Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@gmail.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Tested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
This commit is contained in:
Iván Ezequiel Rodriguez 2026-10-28 12:43:12 -03:00 committed by Catalin Marinas
parent 486d396b19
commit 078e122f3b
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
arch/arm64/Kconfig
View File

@ -199,6 +199,7 @@ config ARM64
select HAVE_SAMPLE_FTRACE_DIRECT_MULTI
select HAVE_BUILDTIME_MCOUNT_SORT
select HAVE_EFFICIENT_UNALIGNED_ACCESS
select HAVE_EXIT_THREAD
select HAVE_GUP_FAST
select HAVE_FTRACE_GRAPH_FUNC
select HAVE_FUNCTION_TRACER

17
arch/arm64/kernel/process.c
View File

@ -320,9 +320,18 @@ static int copy_thread_gcs(struct task_struct *p,
return 0;
}
static void gcs_reset_thread(struct task_struct *task)
{
task->thread.gcs_base = 0;
task->thread.gcs_size = 0;
task->thread.gcspr_el0 = 0;
}
#else
static void flush_gcs(void) { }
static void gcs_reset_thread(struct task_struct *task) { }
static int copy_thread_gcs(struct task_struct *p,
const struct kernel_clone_args *args)
{
@ -341,6 +350,12 @@ void flush_thread(void)
flush_gcs();
}
void exit_thread(struct task_struct *tsk)
{
/* Failed fork after copy_thread(); deactivate_mm() does not run. */
gcs_free(tsk);
}
void arch_release_task_struct(struct task_struct *tsk)
{
fpsimd_release_task(tsk);
@ -503,6 +518,8 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
p->thread.cpu_context.x19 = (unsigned long)args->fn;
p->thread.cpu_context.x20 = (unsigned long)args->fn_arg;
/* Kernel threads sharing the parent's mm must not free its GCS. */
gcs_reset_thread(p);
if (system_supports_poe())
p->thread.por_el0 = POR_EL0_INIT;