linux-kernel - Re: arm64: fp-stress: BUG: KFENCE: memory corruption in fpsimd_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZGOXFjJnSVz3Lss6@finisterre.sirena.org.uk>
Date:   Tue, 16 May 2023 23:45:42 +0900
From:   Mark Brown <broonie@...nel.org>
To:     Will Deacon <will@...nel.org>
Cc:     Naresh Kamboju <naresh.kamboju@...aro.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@...r.kernel.org>,
        linux-stable <stable@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        lkft-triage@...ts.linaro.org,
        Catalin Marinas <catalin.marinas@....com>,
        Dan Carpenter <dan.carpenter@...aro.org>,
        Arnd Bergmann <arnd@...db.de>, Shuah Khan <shuah@...nel.org>,
        Anders Roxell <anders.roxell@...aro.org>
Subject: Re: arm64: fp-stress: BUG: KFENCE: memory corruption in
 fpsimd_release_task

On Tue, May 16, 2023 at 02:44:49PM +0100, Will Deacon wrote:

> Mark -- given that this is an SME allocation, please can you take a look?

I'm on holiday.

> I think the implication of the kfence report is that we're writing beyond
> the end of 'task->thread.sme_state' at some point and corrupting the
> redzone.

> There are two reports here, so hopefully it's not too hard to repro.

I think I *once* saw something that might be this but I've never
reproduced it, and I suspect that if this just suddenly came up with
LKFT in stable kernels when there's been no relevant changes AFAIR it's
not showing up terribly reliably there either.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)