[PW_SID:1148410] riscv: probes: reject kprobes inside LR/SC sequences - #2497
[PW_SID:1148410] riscv: probes: reject kprobes inside LR/SC sequences#2497linux-riscv-bot wants to merge 4 commits into
Conversation
…_RWX When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create temporary writable mappings for read-only executable pages. In this case, the execmem ranges must already have writable permissions. Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC, which causes kprobe instruction slot writes to trigger page faults on systems where CONFIG_STRICT_MODULE_RWX is not enabled. Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX is not available. Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260814082742.148403-2-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
patch_map() always creates a temporary writable mapping via fixmap for kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled and the kernel text is already mapped with _PAGE_WRITE. This is unnecessary overhead at best, and on minimal configurations it can cause page faults. Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX is not enabled, since the text pages are already writable in that case. The module text path is already gated on CONFIG_STRICT_MODULE_RWX and is kept unchanged. Reported-by: Klara Modin <klara@kasm.eu> Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/ Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com> Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/ Tested-by: Klara Modin <klarasmodin@gmail.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260814082742.148403-3-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
A breakpoint trap taken in the middle of an LR/SC sequence clears the load reservation, so an SC following the probed instruction would always fail and the enclosing retry loop would re-enter the breakpoint, livelocking the CPU. Reject probing the LR/SC instructions themselves, and reject probing any address that lies inside an LR/SC sequence by scanning back up to the Zalrsc constrained-loop limit of 64 bytes. Signed-off-by: Xiaofeng Yuan <yuanxiaofeng@eswincomputing.com> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
|
Patch 1: "riscv: probes: reject kprobes inside LR/SC sequences" |
492cc66 to
bb1a926
Compare
3 participants
PR for series 1148410 applied to workflow__riscv__fixes
Name: riscv: probes: reject kprobes inside LR/SC sequences
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1148410
Version: 1