Re: [PATCH 3/9] rv: Reset per-task DA monitors before releasing the slot

[Wen Yang <wen.yang@linux.dev>]

The fix is correct: task_mon_slot = RV_PER_TASK_MONITOR_INIT
equals CONFIG_RV_PER_TASK_MONITORS, which is one past the end of rv[],
so calling da_monitor_reset_all() after rv_put_task_monitor_slot()
would write into whatever memory follows task_struct.rv[] — which is
randomised and can get quite nasty, as you noted in the review thread.

Overlap note: . 
https://lore.kernel.org/all/f654a17c671469fd8fc9ea438daf2266d05068d4.camel@redhat.com/

We will coordinate to avoid redundancy;
we are happy to defer to your version here.


Reviewed-by: Wen Yang <wen.yang@linux.dev>



On 5/12/26 22:02, Gabriele Monaco wrote:
> Per-task monitors use task_mon_slot to determine which slot in the array
> to use for the monitor. During destruction, this slot is returned but
> this is done before resetting the monitor. As a result, the monitor's
> reset is in fact resetting a slot that is outside of the array
> (RV_PER_TASK_MONITOR_INIT).
> 
> Release the slot only after the reset to avoid out-of-bound memory
> access.
> 
> Fixes: 30984ccf31b7f ("rv: Refactor da_monitor to minimise macros")
> Fixes: 792575348ff70 ("rv/include: Add deterministic automata monitor definition via C macros")
> Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
> ---
>   include/rv/da_monitor.h | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h
> index 250888812125..0b7028df08fb 100644
> --- a/include/rv/da_monitor.h
> +++ b/include/rv/da_monitor.h
> @@ -309,10 +309,11 @@ static inline void da_monitor_destroy(void)
>   		WARN_ONCE(1, "Disabling a disabled monitor: " __stringify(MONITOR_NAME));
>   		return;
>   	}
> -	rv_put_task_monitor_slot(task_mon_slot);
> -	task_mon_slot = RV_PER_TASK_MONITOR_INIT;
>   
>   	da_monitor_reset_all();
> +
> +	rv_put_task_monitor_slot(task_mon_slot);
> +	task_mon_slot = RV_PER_TASK_MONITOR_INIT;
>   }
>   
>   #elif RV_MON_TYPE == RV_MON_PER_OBJ