[PATCH] riscv: kprobes: Reject reserved branch encodings

[PATCH] riscv: kprobes: Reject reserved branch encodings

[Zongmin Zhou]

From: Zongmin Zhou <zhouzongmin@kylinos.cn>

simulate_branch() cannot emulate the reserved branch encodings
(funct3 010/011) and returns false for them, but arch_simulate_insn()
ignores the return value. A probe on such an encoding, e.g. placed on
data misdecoded as instructions, therefore keeps the instruction
pointer on the breakpoint, and the CPU traps on it forever.

Reject these encodings in riscv_probe_decode_insn(), like the other
instruction classes already rejected there, so registration fails
with -EINVAL instead. All simulator failure paths then become
unreachable: register indices are bounded by construction, and the
c.jr/c.jalr reserved encodings are already filtered by the decode
predicates.

Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
---
 arch/riscv/kernel/probes/decode-insn.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/riscv/kernel/probes/decode-insn.c b/arch/riscv/kernel/probes/decode-insn.c
index 433d903..c0eadd1 100644
--- a/arch/riscv/kernel/probes/decode-insn.c
+++ b/arch/riscv/kernel/probes/decode-insn.c
@@ -24,6 +24,15 @@ riscv_probe_decode_insn(probe_opcode_t *addr, struct arch_probe_insn *api)
 	RISCV_INSN_REJECTED(system,		insn);
 	RISCV_INSN_REJECTED(fence,		insn);
 
+	/*
+	 * Reserved branch encodings (funct3 010/011): simulate_branch()
+	 * cannot emulate them and its return value is not checked, so a
+	 * probe would trap on the breakpoint forever.
+	 */
+	if (riscv_insn_is_branch(insn) &&
+	    (RV_EXTRACT_FUNCT3(insn) >> 1) == 0x1)
+		return INSN_REJECTED;
+
 	/*
 	 * Simulate instructions list:
 	 * TODO: the REJECTED ones below need to be implemented
-- 
2.34.1


No virus found
		Checked by Hillstone Network AntiVirus


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: kprobes: Reject reserved branch encodings

[Nam Cao]

Zongmin Zhou <min_halo@163.com> writes:
> A probe on such an encoding, e.g. placed on
> data misdecoded as instructions, therefore keeps the instruction
> pointer on the breakpoint, and the CPU traps on it forever.

How can that happen? Isn't probe on data disallowed? And how can the
instruction pointer be on data?

How did you find this issue? If this is from some LLM, please add
Assisted-by: tag.

Nam

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv