From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailout2.samsung.com (mailout2.samsung.com [203.254.224.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0EE74414 for ; Mon, 23 Mar 2026 05:05:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.254.224.25 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774242344; cv=none; b=Pv4SEJTPloceJEq9BJAWytMwMFbfl22lKDCEzLRbOmJEFeURRyYVEtuVL9mV3jf4NhgwD2/b4WqN/nMBvTFrUrOwoedyB4r1oavQH8Ah3SRfd6ytzTApOfZc5qp7+Anhmsr4K9dweyjPXB9slZAIXfxBA0F1py8rXKxsYpwU3e4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774242344; c=relaxed/simple; bh=r9smXfnxeDd4cTLXT2ksmxSBNExqDW8CfAjpJkvunew=; h=Mime-Version:Subject:From:To:CC:In-Reply-To:Message-ID:Date: Content-Type:References; b=J5n6Tb4uiBEDW9eUFqq58ORD+Ea/ZeMXK5vVW++5LVaOuyKDFaHgyTMNPE2w4vkZp4TfV/rsamUisBeO9USrw5sSfOIa6qXZ99XLa8i/qGEOVMvnuFPpBtgTxBpLDGxvzM0FAE16s3rBA3QvtGYPx42jVzUEQlFHI3S4QB+hLA0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com; spf=pass smtp.mailfrom=samsung.com; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b=Xh3fBjJj; arc=none smtp.client-ip=203.254.224.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=samsung.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samsung.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b="Xh3fBjJj" Received: from epcas5p4.samsung.com (unknown [182.195.41.42]) by mailout2.samsung.com (KnoxPortal) with ESMTP id 20260323050538epoutp0228ba42291c3e590f40dc28cebeadbba9~fYAGx8rVq2601126011epoutp020 for ; Mon, 23 Mar 2026 05:05:38 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout2.samsung.com 20260323050538epoutp0228ba42291c3e590f40dc28cebeadbba9~fYAGx8rVq2601126011epoutp020 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1774242338; bh=axqHVHmtwcNrdbsprLI2SCEgZ8QoaKCV+GekRqINVUs=; h=Subject:Reply-To:From:To:CC:In-Reply-To:Date:References:From; b=Xh3fBjJjMC8F5Queg37Dki2QZl5E5BoNLWNXMpbensL33n/YwIgC5H49MqaAgxrzq 2GoOg84+L8EL83E5Vnz06YkuunTT15GPVqLgihHcfRj+57Y/RUZkBKuLpfSxFPb3vd X1Uf6Jty+93+4stXAjb6KiJKVBfPYHg6P3IeonV4= Received: from epsnrtp04.localdomain (unknown [182.195.42.156]) by epcas5p3.samsung.com (KnoxPortal) with ESMTPS id 20260323050538epcas5p314deb32f96500fdd887c3936af033735~fYAGU5XUP2156321563epcas5p31; Mon, 23 Mar 2026 05:05:38 +0000 (GMT) Received: from epcas5p3.samsung.com (unknown [182.195.41.41]) by epsnrtp04.localdomain (Postfix) with ESMTP id 4ffLhy0bjjz6B9mG; Mon, 23 Mar 2026 05:05:38 +0000 (GMT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Subject: RE: [PATCH 1/1] x86: dumpstack: take stack reference before accessing it Reply-To: maninder1.s@samsung.com Sender: Maninder Singh From: Maninder Singh To: Maninder Singh , "jpoimboe@kernel.org" , "peterz@infradead.org" , "tglx@kernel.org" , "mingo@redhat.com" , "bp@alien8.de" , "dave.hansen@linux.intel.com" , "hpa@zytor.com" , "luto@kernel.org" CC: "linux-kernel@vger.kernel.org" , "x86@kernel.org" , Rohit Thapliyal X-Priority: 3 X-Content-Kind-Code: NORMAL In-Reply-To: <20260311052144.2692271-1-maninder1.s@samsung.com> X-Drm-Type: N,general X-Msg-Generator: Mail X-Msg-Type: PERSONAL X-Reply-Demand: N Message-ID: <20260323050537epcms5p3c96d8f60d896dbee3fa78abe4fa855b6@epcms5p3> Date: Mon, 23 Mar 2026 10:35:37 +0530 X-CMS-MailID: 20260323050537epcms5p3c96d8f60d896dbee3fa78abe4fa855b6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" CMS-TYPE: 105P X-CMS-RootMailID: 20260311052153epcas5p3caa5436954e9a2d2e9ec504fe1278a89 References: <20260311052144.2692271-1-maninder1.s@samsung.com> ping=21 Any inputs to this, if it is an actual issue or not ? > --------- Original Message --------- > Sender : Maninder Singh > Date : 2026-03-11 10:51 (GMT+5:30) > Title : =5BPATCH 1/1=5D x86: dumpstack: take stack reference before acce= ssing it >=20 >=20 > with THREAD_INFO_IN_TASK, stack of task can be > freed earlier than task (even if task's reference is taken), > and it needs separate reference with try_get_task_stack() > before using the stack. >=20 > Added a dummy code to save task_struct to reproduce the race in kernel: >=20 > =24 sleep 10 & > =24 take reference of sleep in kernel code in parallel >=20 > =C2=A0=20=C2=A0=20=C2=A0=20=20rcu_read_lock();=0D=0A>=20=C2=A0=20=C2=A0= =20=C2=A0=20=20for_each_process(p)=20=7B=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0= =20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=20if=20(=21strcmp(p->comm,=20=22sle= ep=22))=20=7B=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0= =20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=20check_task=20=3D=20p;=0D= =0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2= =A0=20=C2=A0=20=C2=A0=20=C2=A0=20=20get_task_struct(check_task);=0D=0A>=20= =C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=20=7D=0D=0A= >=20=C2=A0=20=C2=A0=20=C2=A0=20=20=7D=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20= =20rcu_read_unlock();=0D=0A>=20=0D=0A>=20//=20in=20mean=20time=20here=20sle= ep=20binary=20will=20be=20exited,=0D=0A>=20now=20call=20show_stack=20for=20= it.=0D=0A>=20=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=20show_stack(check_task,= =C2=A0=20NULL,=20KERN_EMERG);=0D=0A>=20=0D=0A>=20//OOPs=20here=0D=0A>=20=0D= =0A>=20=5B=C2=A0=20=2049.887151=5D=20BUG:=20unable=20to=20handle=20page=20f= ault=20for=20address:=20ffffb57400213de8=0D=0A>=20...=0D=0A>=20=5B=C2=A0=20= =2049.889329=5D=20CPU:=200=20UID:=200=20PID:=2068=20Comm:=20cat=20Not=20tai= nted=207.0.0-rc2-next-20260302-00003-gb7e059f3a5ae-dirty=20=2349=20PREEMPT(= lazy)=0D=0A>=20=5B=C2=A0=20=2049.889789=5D=20Hardware=20name:=20QEMU=20Stan= dard=20PC=20(i440FX=20+=20PIIX,=201996),=20BIOS=201.15.0-1=2004/01/2014=0D= =0A>=20=5B=C2=A0=20=2049.890204=5D=20RIP:=200010:__unwind_start+0x118/0x1c0= =0D=0A>=20....=0D=0A>=20=5B=C2=A0=20=2049.893485=5D=20Call=20Trace:=0D=0A>= =20=5B=C2=A0=20=2049.893700=5D=C2=A0=20=0D=0A>=20=5B=C2=A0=20=2049.89= 3810=5D=C2=A0=20__show_trace_log_lvl+0x31f/0x360=0D=0A>=20=5B=C2=A0=20=2049= .893988=5D=C2=A0=20?=20mas_store_prealloc+0x99/0x2c0=0D=0A>=20=5B=C2=A0=20= =2049.894169=5D=C2=A0=20meminfo_proc_show+0xdd/0x9a0=0D=0A>=20=5B=C2=A0=20= =2049.894312=5D=C2=A0=20?=20seq_open+0x3b/0x60=0D=0A>=20=5B=C2=A0=20=2049.8= 94435=5D=C2=A0=20?=20__pfx_meminfo_proc_show+0x10/0x10=0D=0A>=20=5B=C2=A0= =20=2049.894568=5D=C2=A0=20?=20file_ra_state_init+0x10/0x30=0D=0A>=20=5B=C2= =A0=20=2049.894731=5D=C2=A0=20?=20__pte_offset_map+0x16/0xd0=0D=0A>=20=5B= =C2=A0=20=2049.894871=5D=C2=A0=20?=20seq_read_iter+0x38e/0x4b0=0D=0A>=20=5B= =C2=A0=20=2049.895004=5D=C2=A0=20seq_read_iter+0x109/0x4b0=0D=0A>=20=5B=C2= =A0=20=2049.895125=5D=C2=A0=20copy_splice_read+0x18f/0x330=0D=0A>=20=5B=C2= =A0=20=2049.895272=5D=C2=A0=20splice_direct_to_actor+0xb4/0x250=0D=0A>=20= =0D=0A>=20Thus=20taking=20reference=20of=20task's=20stack=20before=20access= ing=20it=20in=0D=0A>=20show_stack()=20similar=20to=20get_wchan()=20and=20st= ack_trace_save_tsk().=0D=0A>=20=0D=0A>=20Fixes:=2068f24b08ee89=20(=22sched/= core:=20Free=20the=20stack=20early=20if=20CONFIG_THREAD_INFO_IN_TASK=22)=0D= =0A>=20Signed-off-by:=20Maninder=20Singh=20=0D= =0A>=20---=0D=0A>=20original=20discussion=20for=20sending=20this=20patch=20= for=20comment:=20https://lkml.org/lkml/2026/3/5/299=0D=0A>=20=0D=0A>=20=20a= rch/x86/kernel/dumpstack.c=20=7C=205=20+++++=0D=0A>=20=201=20file=20changed= ,=205=20insertions(+)=0D=0A>=20=0D=0A>=20diff=20--git=20a/arch/x86/kernel/d= umpstack.c=20b/arch/x86/kernel/dumpstack.c=0D=0A>=20index=20b10684dedc58..3= d44db836cd3=20100644=0D=0A>=20---=20a/arch/x86/kernel/dumpstack.c=0D=0A>=20= +++=20b/arch/x86/kernel/dumpstack.c=0D=0A>=20=40=40=20-190,6=20+190,9=20=40= =40=20static=20void=20__show_trace_log_lvl(struct=20task_struct=20*task,=20= struct=20pt_regs=20*regs,=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2= =A0int=20graph_idx=20=3D=200;=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20= =C2=A0bool=20partial=20=3D=20false;=0D=0A>=20=20=0D=0A>=20+=20=C2=A0=20=C2= =A0=20=C2=A0=20=C2=A0if=20(=21try_get_task_stack(task))=0D=0A>=20+=20=C2=A0= =20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0return;=0D= =0A>=20+=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0printk(=22%sCal= l=20Trace:=5Cn=22,=20log_lvl);=0D=0A>=20=20=0D=0A>=20=C2=A0=20=C2=A0=20=C2= =A0=20=C2=A0=20=C2=A0unwind_start(&state,=20task,=20regs,=20stack);=0D=0A>= =20=40=40=20-301,6=20+304,8=20=40=40=20static=20void=20__show_trace_log_lvl= (struct=20task_struct=20*task,=20struct=20pt_regs=20*regs,=0D=0A>=20=C2=A0= =20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0if= =20(stack_name)=0D=0A>=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2= =A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0=20=C2=A0printk(= =22%s=20=5Cn=22,=20log_lvl,=20stack_name);=0D=0A>=20=C2=A0=20=C2=A0=20= =C2=A0=20=C2=A0=20=C2=A0=7D=0D=0A>=20+=0D=0A>=20+=20=C2=A0=20=C2=A0=20=C2= =A0=20=C2=A0put_task_stack(task);=0D=0A>=20=20=7D=0D=0A>=20=20=0D=0A>=20=20= static=20void=20show_trace_log_lvl(struct=20task_struct=20*task,=20struct= =20pt_regs=20*regs,=0D=0A>=20--=20=0D=0A>=202.34.1=0D=0A=0D=0A