arm64/fpsimd: Clear PSTATE.SM during clone()

Currently arch_dup_task_struct() doesn't handle cases where the parent
task has PSTATE.SM==1. Since syscall entry exits streaming mode, the
parent will usually have PSTATE.SM==0, but this can be change by ptrace
after syscall entry. When this happens, arch_dup_task_struct() will
initialise the new task into an invalid state. The new task inherits the
parent's configuration of PSTATE.SM, but fp_type is set to
FP_STATE_FPSIMD, TIF_SVE and SME may be cleared, and both sve_state and
sme_state may be set to NULL.

This can result in a variety of problems whenever the new task's state
is manipulated, including kernel NULL pointer dereferences and leaking
of streaming mode state between tasks.

When ptrace is not involved, the parent will have PSTATE.SM==0 as a
result of syscall entry, and the documentation in
Documentation/arch/arm64/sme.rst says:

| On process creation (eg, clone()) the newly created process will have
| PSTATE.SM cleared.

... so make this true by using task_smstop_sm() to exit streaming mode
in the child task, avoiding the problems above.

Fixes: 8bd7f91c03d8 ("arm64/sme: Implement traps and syscall handling for SME")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20250508132644.1395904-13-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>

diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 3bb7f65bf7b7c2f80d5e4ae80e554e5dafdcc4f9..27a5b0c7ec60b219c72c8f5c66a0f772c6ff4142 100644 (file)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -355,16 +355,13 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
        *dst = *src;
 
        /*
-        * Detach src's sve_state (if any) from dst so that it does not
-        * get erroneously used or freed prematurely.  dst's copies
-        * will be allocated on demand later on if dst uses SVE.
-        * For consistency, also clear TIF_SVE here: this could be done
-        * later in copy_process(), but to avoid tripping up future
-        * maintainers it is best not to leave TIF flags and buffers in
-        * an inconsistent state, even temporarily.
+        * Drop stale reference to src's sve_state and convert dst to
+        * non-streaming FPSIMD mode.
         */
+       dst->thread.fp_type = FP_STATE_FPSIMD;
        dst->thread.sve_state = NULL;
        clear_tsk_thread_flag(dst, TIF_SVE);
+       task_smstop_sm(dst);
 
        /*
         * In the unlikely event that we create a new thread with ZA
@@ -393,8 +390,6 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
                clear_tsk_thread_flag(dst, TIF_SME);
        }
 
-       dst->thread.fp_type = FP_STATE_FPSIMD;
-
        /* clear any pending asynchronous tag fault raised by the parent */
        clear_tsk_thread_flag(dst, TIF_MTE_ASYNC_FAULT);