Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 18 May 2023 10:52:31 +0900
From:   Mark Brown <broonie@kernel.org>
To:     Dan Carpenter <dan.carpenter@linaro.org>
Cc:     Naresh Kamboju <naresh.kamboju@linaro.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>,
        linux-stable <stable@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        lkft-triage@lists.linaro.org,
        Catalin Marinas <catalin.marinas@arm.com>,
        Will Deacon <will@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
        Shuah Khan <shuah@kernel.org>,
        Anders Roxell <anders.roxell@linaro.org>
Subject: Re: arm64: fp-stress: BUG: KFENCE: memory corruption in
 fpsimd_release_task
Message-ID: <ZGWE36pSRMsIHCCa@finisterre.sirena.org.uk>
References: <CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com>
 <2d9a04d8-c09e-49aa-95eb-32b4679f7eba@kili.mountain>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="rY0voc5PYG++8Gkl"
Content-Disposition: inline
In-Reply-To: <2d9a04d8-c09e-49aa-95eb-32b4679f7eba@kili.mountain>
Precedence: bulk


--rY0voc5PYG++8Gkl
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Wed, May 17, 2023 at 10:30:29PM +0300, Dan Carpenter wrote:

> I don't know this code at all so probably this is dumb...  I don't
> undestand how vec_set_vector_length() ensures that sme_state_size()
> stays in sync with the actual size allocated in sme_alloc()

>    866          vl = find_supported_vector_length(type, vl);

> type is ARM64_VEC_SVE.  I've looked at this function for a while and
> I don't see anything which ensures that "vl" is less than the current
> value.

It could be either ARM64_VEC_SVE or ARM64_VEC_SME.

>    917          task_set_vl(task, type, vl);

> "vl" is set here.  This is fine if we are setting it to a smaller value,
> but if we are setting it to a larger value then I think we need to
> realloc the ->sme_state buffer.

> When we call sme_alloc() it will say the buffer is already allocated
> and just zero out what we need for "vl", but the existing buffer is too
> small.

If we are setting the SVE vector length we do not need to reallocate the
SME state since the size of the data stored in the sme_state buffer is
influenced only by the SME vector length, not the SVE vector length.  We
unconditionally free the SVE state (causing it to be reallocated when
needed) since the size needed for it depends on both vector lengths.

--rY0voc5PYG++8Gkl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmRlhN4ACgkQJNaLcl1U
h9DqRwf/X+zviCsIKHpmhoquFCDxBAHtifbeY9wb7j1UxogJFbYb63W1KLOdVX9h
uUTSjLgP3G1TwWgx+MNbcFpJUdANp+ED/6415lmyMYVZiigyYi83JrQWYq83+bnX
uKcvoO78r1sJcj3NUdnhkkzZ/evhtd1Psznv216yAG7/FqaPWW455HlYfb69nqvK
TQxV4sOUeJdn3h4lPMd97aYlwmHbc34lwXHvAShPsn5G/7zRH0/dtF1r1A+CFUwJ
sGK9zUZ2pyRegWb3NCJwu3r2f0FxYUvZrIQuokwUjaKWVq/1pWubTVQUHpebXxF+
NgpH6W6CZg4nWCoS4bEgiqnAYVS2uw==
=uVOX
-----END PGP SIGNATURE-----

--rY0voc5PYG++8Gkl--