Commit 68f24b08ee89 ("sched/core: Free the stack early if
CONFIG_THREAD_INFO_IN_TASK") may cause the task->stack to be freed
during kmemleak_scan() execution, leading to either a NULL pointer
fault (if task->stack is NULL) or kmemleak accessing already freed
memory. This patch uses the new try_get_task_stack() API to ensure that
the task stack is not freed during kmemleak stack scanning.

Fixes: 68f24b08ee89 ("sched/core: Free the stack early if 
Cc: Andrew Morton <>
Cc: Andy Lutomirski <>
Cc: CAI Qian <>
Reported-by: CAI Qian <>
Signed-off-by: Catalin Marinas <>

This was reported in a subsequent comment here:

However, the original bugzilla entry doesn't look related to task stack
freeing as it was first reported on 4.8-rc8. Andy, sorry for cc'ing you
to bugzilla, please feel free to remove your email from the bug above (I
can't seem to be able to do it).

 mm/kmemleak.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index a5e453cf05c4..e5355a5b423f 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1453,8 +1453,11 @@ static void kmemleak_scan(void)
                do_each_thread(g, p) {
-                       scan_block(task_stack_page(p), task_stack_page(p) +
-                                  THREAD_SIZE, NULL);
+                       void *stack = try_get_task_stack(p);
+                       if (stack) {
+                               scan_block(stack, stack + THREAD_SIZE, NULL);
+                               put_task_stack(p);
+                       }
                } while_each_thread(g, p);

Reply via email to