Re: [PATCH v10 5/9] riscv: mm: avoid enabling interrupts for nofault page faults

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Premature exception fixup bypasses vmalloc_fault() on 32-bit RISC-V, breaking nofault accesses to valid vmalloc addresses.
--

commit cb75a61df5b372879cfe9c956e1ab3e4a9d62e0b
Author: Zhanpeng Zhang <zhangzhanpeng.jasper@bytedance.com>

riscv: mm: avoid enabling interrupts for nofault page faults

This commit modifies the page fault handler on RISC-V to handle nofault
accesses and perform exception-table fixups before enabling interrupts or
running tracepoints. This keeps interrupts disabled during nofault accesses
from atomic contexts.

> diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
> index 04ed6f8acae4f..520495420462f 100644
> --- a/arch/riscv/mm/fault.c
> +++ b/arch/riscv/mm/fault.c
> @@ -294,6 +294,13 @@ void handle_page_fault(struct pt_regs *regs)
>  	if (kprobe_page_fault(regs, cause))
>  		return;
>  
> +	/*
> +	 * Nofault accesses must be resolved through the exception table before
> +	 * entering the generic fault path or enabling interrupts.
> +	 */
> +	if (unlikely(faulthandler_disabled()) && fixup_exception(regs))
> +		return;
> +

[Severity: High]
Does this early exception fixup bypass vmalloc fault synchronization on 32-bit
RISC-V?

On 32-bit RISC-V, valid nofault kernel memory accesses to vmalloc addresses
(such as those made by copy_from_kernel_nofault() via bpf_probe_read_kernel()
or /proc/kcore) rely on vmalloc_fault() to lazily synchronize the PGD.

Because copy_from_kernel_nofault() executes with pagefault_disable(),
faulthandler_disabled() evaluates to true. By intercepting this condition and
returning early, we completely bypass vmalloc_fault(), which is called slightly
later in handle_page_fault():

	if ((!IS_ENABLED(CONFIG_MMU) || !IS_ENABLED(CONFIG_64BIT)) &&
	    unlikely(addr >= VMALLOC_START && addr < VMALLOC_END)) {
		vmalloc_fault(regs, code, addr);
		return;
	}

Could this cause legitimate nofault accesses to valid vmalloc addresses to
spuriously fail with -EFAULT instead of completing successfully?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911121456.33223-1-zhangzhanpeng.jasper@bytedance.com?part=5