Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail") corrected two instances, but there was a third instance of this bug. Without setting tsk->stack, if memcg_charge_kernel_stack fails, it'll execute free_thread_stack() on a dangling pointer. Enterprise kernels are compiled with VMAP_STACK=y so this isn't critical, but custom VMAP_STACK=n builds should have some performance advantage, with the drawback of risking to fail fork because compaction didn't succeed. So as long as VMAP_STACK=n is a supported option it's worth fixing it upstream.
Unified · Split
| @@ -248,7 +248,11 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node) · 247 unmodified lines | ||
| 248 | 248 | struct page *page = alloc_pages_node(node, THREADINFO_GFP, |
| 249 | 249 | THREAD_SIZE_ORDER); |
| 250 | 250 | |
| 251 | − return page ? page_address(page) : NULL; | |
| 251 | + if (likely(page)) { | |
| 252 | + tsk->stack = page_address(page); | |
| 253 | + return tsk->stack; | |
| 254 | + } | |
| 255 | + return NULL; | |
| 252 | 256 | #endif |
| 253 | 257 | } |
| 254 | 258 | |