Re: [PATCH v2 1/2] x86/fpu: Fix memory leak with dynamic fpstate and exec()

[Guixiong Wei]

> From: "Chang S. Bae"<chang.seok.bae@xxxxxxxxx>
> Date:  Wed, Oct 21, 2026, 02:21
> Subject:  Re: [PATCH v2 1/2] x86/fpu: Fix memory leak with dynamic fpstate and exec()
> To: "Guixiong Wei"<weiguixiong@xxxxxxxxxxxxx>
> Cc: <x86@xxxxxxxxxx>, "Thomas Gleixner"<tglx@xxxxxxxxxx>, "Ingo Molnar"<mingo@xxxxxxxxxx>, "Borislav Petkov"<bp@xxxxxxxxx>, "Dave Hansen"<dave.hansen@xxxxxxxxxxxxxxx>, "H . Peter Anvin"<hpa@xxxxxxxxx>, <linux-kernel@xxxxxxxxxxxxxxx>, <stable@xxxxxxxxxxxxxxx>
> On 10/19/2026 6:49 PM, Guixiong Wei wrote:
> > 
> >      void fpstate_free(struct fpu *fpu)
> >      {
> >              __fpstate_free(fpu->fpstate);
> >      }
> 
> Hmm, just curious why the original check has to be removed. I thought 
> this sanity check from the struct fpu context was reasonable, no?
> 
>    void fpstate_free(struct fpu *fpu)
>    {
>        if (fpu->fpstate && fpu->fpstate != &fpu->__fpstate)
>             __fpstate_free(fpu->fpstate);
>    }
> 
> Thanks,
> Chang
> 
Right, will restore it in v3.

With that check back, __fpstate_free() ends up with fpstate_realloc()
as its only real caller, so I'd prefer to drop the helper and keep
both free sites inline — same shape as before v2:

    void fpstate_free(struct fpu *fpu)
    {
            if (fpu->fpstate && fpu->fpstate != &fpu->__fpstate)
                    vfree(fpu->fpstate);
    }

    /* fpstate_realloc(), unchanged: */
    if (curfps && curfps->is_valloc)
            vfree(curfps);

The fix then collapses to two changes in core.c: free the dynamic
fpstate at the start of fpstate_reset(), and clear dst_fpu->fpstate
to NULL in fpu_clone() before the reset. xstate.c, api.h and
process.c stay untouched.

OK with you?

Thanks,
Guixiong