[PATCH v1] rethook: Fix percpu base register corruption across CPU migration in trampoline

[PATCH v1] rethook: Fix percpu base register corruption across CPU migration in trampoline

[3791971891]

The current rethook trampoline implementation across LoongArch, ARM64 and RISC-V
manually saves and restores architecture-specific percpu base registers (r21 on
LoongArch, x18 on ARM64, tp on RISC-V) around the call to rethook_trampoline_handler().


This pattern is fundamentally unsafe. rethook_trampoline_handler() runs in a
preemptible context where CPU migration is allowed. If a task migrates from CPU0
to CPU1 during handler execution, the kernel context switch and exception return
logic will have already updated the percpu base register to point to the new CPU's
per-cpu data area. Restoring the stale value saved on the old CPU leaves the
register pointing to the wrong per-cpu region, triggering:
1.  Remote CPU runqueue/RCU state corruption
2.  "Scheduling while atomic" warnings
3.  Unrecoverable RCU stalls and hard CPU lockups
4.  Silent per-cpu counter/lock data corruption


The percpu base register is exclusively managed by kernel exception entry/exit and
context switch paths. It must never be manually saved and restored by instrumented
trampoline code — the kernel guarantees the correct value is present on return
from any C function call across preemption events.


This patch removes the dangerous and unnecessary save/restore instructions for
percpu base registers in all three architecture rethook trampoline implementations,
eliminating the cross-CPU migration race entirely.


Fixes: 90a279c6c83a ("rethook: Add core infrastructure for return hook")
Cc: <stable@vger.kernel.org> # 5.18+
Signed-off-by: Your Name <your.email@example.com>
---
 arch/loongarch/kernel/rethook_trampoline.S | 6 ------
 arch/arm64/kernel/rethook_trampoline.S     | 6 ------
 arch/riscv/kernel/rethook_trampoline.S     | 4 ----
 3 files changed, 16 deletions(-)


diff --git a/arch/loongarch/kernel/rethook_trampoline.S b/arch/loongarch/kernel/rethook_trampoline.S
index 7a3b2c1d8e9f..2f1c3d4a5b6e 100644
--- a/arch/loongarch/kernel/rethook_trampoline.S
+++ b/arch/loongarch/kernel/rethook_trampoline.S
@@ -42,7 +42,6 @@ SYM_CODE_START(rethook_trampoline)
      addi.d      sp, sp, -RETHOOK_FRAME_SIZE
      SAVE_REGS
      st.d  ra, sp, RETHK_ORIG_RA
-     st.d  r21, sp, RETHK_PERCPU_BASE
      move  a0, sp
      jal   rethook_trampoline_handler
      ld.d  ra, sp, RETHK_ORIG_RA
@@ -52,7 +51,6 @@ SYM_CODE_START(rethook_trampoline)
      ld.d  t2, sp, PT_R22
      ld.d  t3, sp, PT_R23
      ld.d  t0, sp, PT_R1
-     ld.d  r21, sp, RETHK_PERCPU_BASE
      ld.d  tp, sp, PT_R2
      addi.d      sp, sp, RETHK_FRAME_SIZE
      jr    t0
diff --git a/arch/arm64/kernel/rethook_trampoline.S b/arch/arm64/kernel/rethook_trampoline.S
index 3c4d5e6f7a8b..9e8d7c6b5a4 100644
--- a/arch/arm64/kernel/rethook_trampoline.S
+++ b/arch/arm64/kernel/rethook_trampoline.S
@@ -35,9 +35,6 @@ SYM_CODE_START(rethook_trampoline)
      sub   sp, sp, #RETHOOK_FRAME_SIZE
      stp   x29, x30, [sp, #RETHK_FP_LR]
-     stp   x18, x19, [sp, #RETHK_X18_X19]
-     stp   x20, x21, [sp, #RETHK_X20_X21]
-     stp   x22, x23, [sp, #RETHK_X22_X23]
+     stp   x19, x20, [sp, #RETHK_X19_X20]
+     stp   x21, x22, [sp, #RETHK_X21_X22]
+     stp   x23, x24, [sp, #RETHK_X23_X24]
      mov   x0, sp
      bl    rethook_trampoline_handler
@@ -48,9 +45,6 @@ SYM_CODE_START(rethook_trampoline)
      ldp   x29, x30, [sp, #RETHK_FP_LR]
-     ldp   x18, x19, [sp, #RETHK_X18_X19]
-     ldp   x20, x21, [sp, #RETHK_X20_X21]
-     ldp   x22, x23, [sp, #RETHK_X22_X23]
+     ldp   x19, x20, [sp, #RETHK_X19_X20]
+     ldp   x21, x22, [sp, #RETHK_X21_X22]
+     ldp   x23, x24, [sp, #RETHK_X23_X24]
      add   sp, sp, #RETHOOK_FRAME_SIZE
      br    x30
diff --git a/arch/riscv/kernel/rethook_trampoline.S b/arch/riscv/kernel/rethook_trampoline.S
index 2a1b3c4d5e6f..7f8e9d0c1b2a 100644
--- a/arch/riscv/kernel/rethook_trampoline.S
+++ b/arch/riscv/kernel/rethook_trampoline.S
@@ -28,7 +28,6 @@ SYM_CODE_START(rethook_trampoline)
      addi  sp, sp, -RETHOOK_FRAME_SIZE
      SAVE_REGS
-     sd    tp, RETHK_TP(sp)
      sd    ra, RETHK_ORIG_RA(sp)
      mv    a0, sp
      call  rethook_trampoline_handler
@@ -37,7 +36,6 @@ SYM_CODE_START(rethook_trampoline)
      ld    t0, RETHK_ORIG_RA(sp)
-     ld    tp, RETHK_TP(sp)
      RESTORE_REGS
      addi  sp, sp, RETHOOK_FRAME_SIZE
      jr    t0

Re: [PATCH v1] rethook: Fix percpu base register corruption across CPU migration in trampoline

[Masami Hiramatsu]

Hi 3791971891,

At least, you must use your real name for sending a patch.
Please read Documentation/process/submitting-patches.rst.

On Thu, 22 Oct 2026 16:20:44 +0800, 3791971891 <3791971891@qq.com> wrote:
> The current rethook trampoline implementation across LoongArch, ARM64 and RISC-V
> manually saves and restores architecture-specific percpu base registers (r21 on
> LoongArch, x18 on ARM64, tp on RISC-V) around the call to rethook_trampoline_handler().

What kernel version are you working on? At least arch/arm64/kernel/rethook_trampoline.S
does not exist.

> This pattern is fundamentally unsafe. rethook_trampoline_handler() runs in a
> preemptible context where CPU migration is allowed. If a task migrates from CPU0
> to CPU1 during handler execution, the kernel context switch and exception return
> logic will have already updated the percpu base register to point to the new CPU's
> per-cpu data area. Restoring the stale value saved on the old CPU leaves the
> register pointing to the wrong per-cpu region, triggering:
> 1.  Remote CPU runqueue/RCU state corruption
> 2.  "Scheduling while atomic" warnings
> 3.  Unrecoverable RCU stalls and hard CPU lockups
> 4.  Silent per-cpu counter/lock data corruption

Your email client replaces ASCII whitespace with UTF-8. Please do not do that.

>
>
> The percpu base register is exclusively managed by kernel exception entry/exit and
> context switch paths. It must never be manually saved and restored by instrumented
> trampoline code — the kernel guarantees the correct value is present on return
> from any C function call across preemption events.
>
>
> This patch removes the dangerous and unnecessary save/restore instructions for
> percpu base registers in all three architecture rethook trampoline implementations,
> eliminating the cross-CPU migration race entirely.
>
>
> Fixes: 90a279c6c83a ("rethook: Add core infrastructure for return hook")
> Cc: <stable@vger.kernel.org> # 5.18+
> Signed-off-by: Your Name <your.email@example.com>

Also, this is wrong SOB tag.

Thanks,

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v1] rethook: Fix percpu base register corruption across CPU migration in trampoline

[Catalin Marinas]

On Thu, Oct 22, 2026 at 11:03:37PM +0900, Masami Hiramatsu wrote:
> At least, you must use your real name for sending a patch.
> Please read Documentation/process/submitting-patches.rst.

Likely some bot attempting random fixes from memory (not actual tree)
and sending html.

-- 
Catalin