Re: [PATCH v3 1/2] x86/fpu: Fix memory leak with dynamic fpstate and exec()

["Chang S. Bae" <chang.seok.bae@intel.com>]

On 10/26/2026 8:44 PM, Guixiong Wei wrote:
>   
>   void fpstate_reset(struct fpu *fpu)
>   {
> +	/* Free dynamic fpstate (if any) before resetting pointer: */
> +	fpstate_free(fpu);
> +

Did you check Sashiko review there?
https://sashiko.dev/#/patchset/cover.1793072271.git.weiguixiong%40bytedance.com

The point looks valid to me.

I think one way to fix it is to set TIF_NEED_FPU_LOAD in
fpu_flush_thread() before the reset. Maybe something like:

diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index d1aeecd57f5e..f474fc357281 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -592,8 +592,15 @@ static void __fpstate_reset(struct fpstate *fpstate)
         fpstate->user_xfeatures = fpu_user_cfg.default_features;
  }

+/*
+ * Callers resetting the current task must ensure that its FPU register 
state
+ * isn't saved on context switch as the buffer may be freed here.
+ */
  void fpstate_reset(struct fpu *fpu)
  {
+       /* Free dynamic fpstate (if any) before resetting pointer: */
+       fpstate_free(fpu);
+
         /* Set the fpstate pointer to the default fpstate */
         fpu->fpstate = &fpu->__fpstate;
         __fpstate_reset(fpu->fpstate);
@@ -670,6 +677,8 @@ int fpu_clone(struct task_struct *dst, u64 
clone_flags, bool minimal,
         /* The new task's FPU state cannot be valid in the hardware. */
         dst_fpu->last_cpu = -1;

+       /* Break the link to the other FPU's fpstate: */
+       dst_fpu->fpstate = NULL;
         fpstate_reset(dst_fpu);

         if (!cpu_feature_enabled(X86_FEATURE_FPU))
@@ -866,6 +875,9 @@ void fpu__clear_user_states(struct fpu *fpu)

  void fpu_flush_thread(void)
  {
+       /* Prevent the hardware state from being saved on context switch */
+       set_thread_flag(TIF_NEED_FPU_LOAD);
+
         fpstate_reset(x86_task_fpu(current));
         fpu_reset_fpstate_regs();

Thanks,
Chang