Re: [PATCH v2] fork: initialize functi on graph state before copy_exec_state()

On 22 August 2026 08:49:27 BST, Jérémy Jean
<[email protected]> wrote:
>From: Jérémy Jean <[email protected]>
>
>KASAN reports:
>
>[   22.195899] BUG: KASAN: slab-use-after-free in
>function_graph_enter_regs+0xa76/0xb90
>[   22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1

Perfect!

>[   22.278296]  __kasan_slab_free+0x43/0x70
>[   22.280157]  kmem_cache_free+0xbf/0x3b0
>[   22.282963]  ? ftrace_stub_direct_tramp+0x10/0x10
>[   22.284001]  free_task+0xa2/0x160
>[   22.285699]  ? ftrace_stub_direct_tramp+0x10/0x10
>[   22.286752]  copy_process+0x2aae/0x7bc0

And the free stack is exactly the mechanism from the changelog,
free_task() under copy_process()'s error path dropping the stack, then
the parent writes into it afterwards. Stable folks will love this.

>diff --git a/kernel/fork.c b/kernel/fork.c
>+ /*
>+  * Must run before the first fallible op, so error paths never
>+  * free the parent's ret_stack.
>+  */
>+ ftrace_graph_init_task(p);

And the comment landed too. Nice!

Reviewed-by: Bradley Morgan <[email protected]>

Thanks!