Re: [PATCH v3] bpf, riscv: fix extable handling for arena load_acquire

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] When generating a `BPF_CMPXCHG` instruction without the `ZACAS` extension, `emit_cmpxchg()` emits a standard `lr`/`sc` loop but fails to set `ctx->ex_insn_off` and `ctx->ex_jmp_off`. This causes `add_exception_handler()` to silently skip adding an exception table entry, leading to an unhandled kernel page fault (Oops) if the atomic operation accesses invalid arena memory.
--

--- Patch [1]: [PATCH v3] bpf, riscv: fix extable handling for arena load_acquire ---
commit fa077ce2664d4c4babfa668d0c19369f9d827836
Author: Feng Jiang <jiangfeng@kylinos.cn>

bpf, riscv: fix extable handling for arena load_acquire

This patch modifies the BPF RISC-V JIT to ensure that an exception table
entry is correctly added for PROBE_ATOMIC load_acquire instructions. It also
ensures the destination register is zeroed on fault instead of being left
stale.

> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966b..e1519ab4356c1 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -1986,7 +1986,12 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>  		else
>  			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>  
> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
> +		if (ret >= 0)
> +			ret = add_exception_handler(insn,
> +				insn->imm == BPF_LOAD_ACQ ? rd : REG_DONT_CLEAR_MARKER,
> +				ctx) ?: ret;
> +

[Severity: High]
This isn't a bug introduced by this patch, but does emit_cmpxchg() fail to
set ctx->ex_insn_off and ctx->ex_jmp_off on machines without the ZACAS
extension?

Looking at emit_atomic_rmw(), it calls emit_cmpxchg() for BPF_CMPXCHG.
If emit_cmpxchg() falls back to a standard lr/sc loop:

	emit(is64 ? rv_lr_d(r0, 0, rd, 0, 0) :
	     rv_lr_w(r0, 0, rd, 0, 0), ctx);

Because ctx->ex_insn_off is left at 0, won't add_exception_handler() simply
return early without adding an exception table entry?

This seems like it could cause an unhandled kernel page fault (Oops) if a
PROBE_ATOMIC cmpxchg accesses invalid arena memory.

>  		if (ret)
>  			return ret;
>  		break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-bpf-riscv-fix-extable-v3-1-e9a603882309@kylinos.cn?part=1