From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.127.230.111 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793072701; b=J5YxE6XvWOg1KrV89eJPA0V6H2v/yaxqvigW8xbjbngQm3CbqYtsUl/iJmyZ1SWm8ll7 f1AUv+J1pz9wuN3IZTfgQBIdgfSMQkgiYIqsKvvoWi5QOU/2lzCO/Dkua+SLDfqDBopl6 2wKMbdEOM5lP+vn2Ljpo/OfmVYzi4dYT42Rc1Ev2PYOQZaHwpa35B+mKyu+lv4Oa0QNY3 zLAZJIjma6W0sTCT6vhUTbcGv0wxgjUkD+VSrqLtECrpD/KthkFSfhWuW0EGIZcG0EVRR RBcnOOopYWq+eL6sUdXFFhzrKjneY7UYZltJ2BR5OHEAMEf/sNMqO8WDBjixyd6biyQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793072701; h=DMARC-Filter:DKIM-Signature:To:Subject:Message-Id:X-Mailer:From:Cc: Date:Mime-Version:X-Original-From:Content-Transfer-Encoding: Content-Type:X-Lms-Return-Path; bh=ULr9bgQ6yFnrOUoUUAJX9WlVlG9/9n0WdEkZqyzIDlU=; b=PUdrfvnfuwF+IzcUBYl3krWa5BjKJ7Ll7LDHyOnusI/80JS+k/6LMv7oJd3AvaoVVE4k KGwGZa8VbXcl6EdTvWyYoxhIOkRrZtHHVMjuB/0hyXNrRHUUro3MwKbPPh4BgCcLEgjOa LfepIDyib2uaLNzHBPDlMyk6t7XiQ8sQUszJOen495vvng4m8QOUSFVu/9bcJnNXfIxTB PRSkyHPH5Y/Yv9PvQfNIF7n6byx328Hc/3X/sSagurNkT2rnE/AmGFdsK+ZId+uraXXij x2uyvO4WzDQ7OhpwROKj4Jr/2kGBHxnWYF62WwEECXfalOAmORkiFK3b4ijGY1Ki18A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass header.d=bytedance.com header.i=@bytedance.com header.a=rsa-sha256 header.s=2212171451 header.b=G5X6RFgY; arc=none smtp.remote-ip=209.127.230.111 Received: from va-1-111.ptr.blmpb.com (va-1-111.ptr.blmpb.com [209.127.230.111]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A3E8606A31A for ; Tue, 27 Oct 2026 03:44:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 6A3E8606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=bytedance.com header.i=@bytedance.com header.a=rsa-sha256 header.s=2212171451 header.b=G5X6RFgY DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=2212171451; d=bytedance.com; t=1793072689; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=ULr9bgQ6yFnrOUoUUAJX9WlVlG9/9n0WdEkZqyzIDlU=; b=G5X6RFgYys8sHCve15qtWmiByr09G/qIaVrk4ZegEXxI+AO9FZqJdCEvdAxDxROb1sXII1 8tUTcaZGTBOr2jmTBR7LFd9y1+ysnAyl1WOvpgtVYRzaVy0oTN71DEaH07WWN/T3ioPE2s dcWpbwB3uwEGpOfKhZ3y9ZlSGwCPIpzKIhz0DFD70Oefa/vPdZat2HDUL+UBI/iEczaLNC woHf+dibHCzeiIwmZ1k4cWvQVBw20+DAcVhYwfwmv+OFWM4a9sT1p8tCoQetU3oj18NPoh JhtKwzLxbFSlRLIPdM0mvYhzpBuq7R5kjODmCtfkoLuYmrh8b5vzuTvn/hUmKw== To: Subject: [PATCH v3 0/2] x86/fpu: Fix dynamic fpstate leak on exec() Message-Id: X-Mailer: git-send-email 2.55.0 From: "Guixiong Wei" Cc: , , , , , , , , , , "Guixiong Wei" Date: Tue, 27 Oct 2026 11:44:28 +0800 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 X-Original-From: Guixiong Wei Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=UTF-8 X-Lms-Return-Path: An exec() after using an XFD-controlled xfeature leaks the dynamically allocated fpstate. Fix the cleanup in fpstate_reset() and add an AMX regression selftest. The selftest reports FAIL on an unfixed kernel (verified 10/10 FAILs on 7.1.3 with the leak reproducer present) and OK with the fix applied. Changes since v2: - Free dynamic state at the start of fpstate_reset(), keeping the fpstate_free() interface unchanged. Clear the inherited fpstate pointer in fpu_clone() before resetting it. - Replace nested self-exec with a parent fork()/exec() loop. - Add a pipe-synchronised pre-flight check that confirms the dynamic allocation is observable via /proc/vmallocinfo before measuring the post-exec() delta. Without that gate "no new entries" is ambiguous between "freed" and "never observed" and would silently PASS on kernels where the allocation is not reachable. /proc/vmallocinfo is the only user-visible signal for a leaked post-exec() fpstate (it has no task scope once the task is gone). - Compare the set of allocation start addresses in /proc/vmallocinfo before and after the loop; addresses present only in the "after" snapshot count as new allocations that outlived their task. This compares allocation identity directly, so unrelated vmalloc churn elsewhere does not change the result. SKIP if any matching entry's address is hidden (kptr_restrict) because the diff can no longer distinguish allocations. - Report leak failures without preventing subsequent subtests from running, and simplify the commit messages. v2: https://lore.kernel.org/r/cover.1791428412.git.weiguixiong@bytedance.com v1: https://lore.kernel.org/r/20260929151013.81562-2-weiguixiong@bytedance.com Guixiong Wei (2): x86/fpu: Fix memory leak with dynamic fpstate and exec() selftests/x86/amx: Test dynamic fpstate cleanup across exec() arch/x86/kernel/fpu/core.c | 5 + tools/testing/selftests/x86/amx.c | 251 +++++++++++++++++++++++++++++- 2 files changed, 254 insertions(+), 2 deletions(-) base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e -- 2.55.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.127.230.113 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793072748; b=AK94MSuX0VS16ghCIdTV8Vh1jVaUs0QkzTTzDfP6NDgGfmEDNAlpKwP3y0TsHcyhtS1I uIyQBvyVGBgvRaZ09p58elDAKBPWLF0Xw4ru30Q/AncWkxrAo1o98Wn0d6cTMLoXRTCRE tsvQhU4BQP29J5hk9Bwi/U0dQ10mD9paHgNe3XjUj9f8kcZb5JuuR/bgGhOUvRSTgOAq3 dnQPB1gb/0UKmR+lmDu9Yjl71Cnx4dVmEp5N9n9UGQJblyFYu90yXORdJ+U9CdVnYF7ff jg0Yd5I8fq937lftkyJdR8Die8KC9ebE4QKL90a7/C5Aqx2qvj44PnDD8pwrTAa92nw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793072748; h=DMARC-Filter:DKIM-Signature:Cc:Subject:Date:Message-Id: X-Original-From:To:X-Mailer:Content-Transfer-Encoding: X-Lms-Return-Path:Content-Type:From:Mime-Version; bh=ULr9bgQ6yFnrOUoUUAJX9WlVlG9/9n0WdEkZqyzIDlU=; b=rZnwN+F98WJn7CAfvKzQu2LvqtM7dnuD+655Pcnjv7LhPJUrImo/KlmtASPECquz2gKp X6ZOAElsvko+J+Ye4OV3e65z0lwmyKntPOqOsjb5fzRgRyqmrUMZz3iqdjYeaEp202PHr V0InuFSxzqTG+q0JL9tOerqkjWykOdfU3NTpn+iBfFPceBZA2vcqbU7Re9Ln8TgmrK96+ FonXV8eEaIcOTD1fU8BS9vSX0AMLo6dsQ4eSz+lQcO+qWfmxHZzthiuTA0tQFHvSCoLfM 433Uwkj8DVE1Yz7DUH/3BohF6n3LkKkMF+JnfLkbPG+WlhHMa3Ao2anAGjisAamWCbg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass header.d=bytedance.com header.i=@bytedance.com header.a=rsa-sha256 header.s=2212171451 header.b=KRUnrtrp; arc=none smtp.remote-ip=209.127.230.113 Received: from va-1-113.ptr.blmpb.com (va-1-113.ptr.blmpb.com [209.127.230.113]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07454606A32A for ; Tue, 27 Oct 2026 03:45:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 07454606A32A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=bytedance.com header.i=@bytedance.com header.a=rsa-sha256 header.s=2212171451 header.b=KRUnrtrp DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=2212171451; d=bytedance.com; t=1793072743; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=ULr9bgQ6yFnrOUoUUAJX9WlVlG9/9n0WdEkZqyzIDlU=; b=KRUnrtrpDHoHc9xFObs/VqlzU5RuhQYm6qR2sL5250j7/HOS7KOp19kT69VrDHpbdvguUJ Jsm9FKzTgb9UqYk+yxX+JhL4y7bxoZQirCbiT2Un9WV9jIN13k/Aah+vsw8R5QVbqGIGcE F4WQvQYSKlIbWfM8zx1ZJJ0nAk2drbyeIVWXl0qEm+w5YskqS3cyeE7cDKU+IVoH+L1368 T3enpr70PR0lWdxvrNH8eVViwbcGgiDnAKSIcUMmEp+s1uFHccriOKZ68Zikfl6LKWAt69 7T0JgNqPGiXxnMo88MmcE/n2QtJ9FgmxRGoUh00DhcPNnJEH5xEkIfpj48BI+Q== Cc: , , , , , , , , , , "Guixiong Wei" Subject: [PATCH v3 0/2] x86/fpu: Fix dynamic fpstate leak on exec() Date: Tue, 27 Oct 2026 11:45:25 +0800 Message-ID: X-Original-From: Guixiong Wei To: X-Mailer: git-send-email 2.55.0 Content-Transfer-Encoding: 7bit X-Lms-Return-Path: Content-Type: text/plain; charset=UTF-8 From: "Guixiong Wei" X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 Message-ID: <20261027034525.n_XFdGRdfYdist2-1b1BUKZ4u1Fn2qa1xpUPfMZRII8@z> An exec() after using an XFD-controlled xfeature leaks the dynamically allocated fpstate. Fix the cleanup in fpstate_reset() and add an AMX regression selftest. The selftest reports FAIL on an unfixed kernel (verified 10/10 FAILs on 7.1.3 with the leak reproducer present) and OK with the fix applied. Changes since v2: - Free dynamic state at the start of fpstate_reset(), keeping the fpstate_free() interface unchanged. Clear the inherited fpstate pointer in fpu_clone() before resetting it. - Replace nested self-exec with a parent fork()/exec() loop. - Add a pipe-synchronised pre-flight check that confirms the dynamic allocation is observable via /proc/vmallocinfo before measuring the post-exec() delta. Without that gate "no new entries" is ambiguous between "freed" and "never observed" and would silently PASS on kernels where the allocation is not reachable. /proc/vmallocinfo is the only user-visible signal for a leaked post-exec() fpstate (it has no task scope once the task is gone). - Compare the set of allocation start addresses in /proc/vmallocinfo before and after the loop; addresses present only in the "after" snapshot count as new allocations that outlived their task. This compares allocation identity directly, so unrelated vmalloc churn elsewhere does not change the result. SKIP if any matching entry's address is hidden (kptr_restrict) because the diff can no longer distinguish allocations. - Report leak failures without preventing subsequent subtests from running, and simplify the commit messages. v2: https://lore.kernel.org/r/cover.1791428412.git.weiguixiong@bytedance.com v1: https://lore.kernel.org/r/20260929151013.81562-2-weiguixiong@bytedance.com Guixiong Wei (2): x86/fpu: Fix memory leak with dynamic fpstate and exec() selftests/x86/amx: Test dynamic fpstate cleanup across exec() arch/x86/kernel/fpu/core.c | 5 + tools/testing/selftests/x86/amx.c | 251 +++++++++++++++++++++++++++++- 2 files changed, 254 insertions(+), 2 deletions(-) base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e -- 2.55.0