Skip to content

[PW_SID:1119219] riscv: probes: save original sp in rethook trampoline#2177

Closed
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1119219
Closed

[PW_SID:1119219] riscv: probes: save original sp in rethook trampoline#2177
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1119219

Conversation

@linux-riscv-bot

@linux-riscv-bot linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown

PR for series 1119219 applied to workflow__riscv__fixes

Name: riscv: probes: save original sp in rethook trampoline
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1119219
Version: 1

Linux RISC-V bot and others added 2 commits June 25, 2026 20:36
Adding CI files
4d827ba
@martin-kaiser
riscv: probes: save original sp in rethook trampoline
6c4c499 
Reading a word from the stack in a kretprobe crashes a risc-v kernel.

$ cd /sys/kernel/tracing/
$ echo 'r n_tty_write $stack0' > dynamic_events
$ echo 1 > events/kprobes/enable
Unable to handle kernel paging request at virtual address 0000000200000128
...
[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
[<ffffffff8067872a>] tty_write+0x1a/0x30

In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.

arch_rethook_trampoline saves the registers from the probed function in a
struct pt_regs. sp is not saved. Instead, sp is decremented for
arch_rethook_trampoline's local stack.

Fix this crash and save the original sp along with the other registers.
Use a0 as a temporary register, it is overwritten anyway.

Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 152.15 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1422.15 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1848.30 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 29.40 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 30.29 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.70 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 88.91 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
kdoc
Desc: Detects for kdoc errors
Duration: 0.81 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.23 seconds
Result: PASS

@linux-riscv-bot

linux-riscv-bot commented Jun 30, 2026

Copy link
Copy Markdown
Author

Patch 1: "riscv: probes: save original sp in rethook trampoline"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.31 seconds
Result: PASS

@linux-riscv-bot
linux-riscv-bot force-pushed the workflow__riscv__fixes branch from 4d827ba to 89be0ce Compare July 1, 2026 03:48
@linux-riscv-bot
linux-riscv-bot deleted the pw1119219 branch July 1, 2026 03:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@linux-riscv-bot @martin-kaiser