wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-06 22:10:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

linuxkm/x86_vector_register_glue.c: fix struct pid refcount leak from find_get_pid() in wc_linuxkm_fpu_state_assoc_unlikely().

Browse Source 
find_get_pid() returns a struct pid * with the refcount bumped via
get_pid(); callers must release it with put_pid().  The probe here is
purely a liveness check on the slot's previous owner, and the returned
pointer was discarded -- leaking one struct pid reference every time
the unlikely contested-slot path was hit with a still-live owner.

Capture the pointer and put_pid() it on the live-owner branch;
behavior on the orphaned-slot branch is unchanged.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
This commit is contained in:
Sameeh Jubran
2026-04-27 16:20:13 +03:00
parent 2f660a3f7b
commit 75dc3e13fd
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
linuxkm/x86_vector_register_glue.c
+7 -1
View File
@@ -162,16 +162,22 @@ static struct wc_thread_fpu_count_ent *wc_linuxkm_fpu_state_assoc_unlikely(int c
__atomic_store_n(&slot->pid, my_pid, __ATOMIC_RELEASE);
return slot;
} else {
struct pid *slot_pid_struct;
/* if the slot is already occupied, that can be benign-ish due to a
* unwanted migration, or due to a process crashing in kernel mode.
* it will require fixup either here, or by the thread that owns the
* slot, which will happen when it releases its lock.
*/
if (find_get_pid(slot_pid) == NULL) {
slot_pid_struct = find_get_pid(slot_pid);
if (slot_pid_struct == NULL) {
if (__atomic_compare_exchange_n(&slot->pid, &slot_pid, my_pid, 0, __ATOMIC_SEQ_CST, __ATOMIC_ACQUIRE)) {
pr_warn("WARNING: wc_linuxkm_fpu_state_assoc_unlikely fixed up orphaned slot on CPU %d owned by dead PID %d.\n", my_cpu, slot_pid);
return slot;
}
} else {
/* drop the refcount bumped by find_get_pid(). */
put_pid(slot_pid_struct);
}
{