[PATCH] riscv: probes: save original sp in rethook trampoline

[PATCH] riscv: probes: save original sp in rethook trampoline

[Martin Kaiser]

Reading a word from the stack in a kretprobe crashes a risc-v kernel.

$ cd /sys/kernel/tracing/
$ echo 'r n_tty_write $stack0' > dynamic_events
$ echo 1 > events/kprobes/enable
Unable to handle kernel paging request at virtual address 0000000200000128
...
[<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
[<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
[<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
[<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
[<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
[<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
[<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
[<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
[<ffffffff8067872a>] tty_write+0x1a/0x30

In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.

arch_rethook_trampoline saves the registers from the probed function in a
struct pt_regs. sp is not saved. Instead, sp is decremented for
arch_rethook_trampoline's local stack.

Fix this crash and save the original sp along with the other registers.
Use a0 as a temporary register, it is overwritten anyway.

Signed-off-by: Martin Kaiser <martin@kaiser.cx>
---
 arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/riscv/kernel/probes/rethook_trampoline.S b/arch/riscv/kernel/probes/rethook_trampoline.S
index f2cd83d9b0f0..c3aa8d8cf5af 100644
--- a/arch/riscv/kernel/probes/rethook_trampoline.S
+++ b/arch/riscv/kernel/probes/rethook_trampoline.S
@@ -41,6 +41,9 @@
 	REG_S x29, PT_T4(sp)
 	REG_S x30, PT_T5(sp)
 	REG_S x31, PT_T6(sp)
+	/* save original sp */
+	addi a0, sp, PT_SIZE_ON_STACK
+	REG_S a0, PT_SP(sp)
 	.endm
 
 	.macro restore_all_base_regs
-- 
2.43.7

Re: [PATCH] riscv: probes: save original sp in rethook trampoline

[Masami Hiramatsu]

On Tue, 30 Jun 2026 21:40:03 +0200
Martin Kaiser <martin@kaiser.cx> wrote:

> Reading a word from the stack in a kretprobe crashes a risc-v kernel.
> 
> $ cd /sys/kernel/tracing/
> $ echo 'r n_tty_write $stack0' > dynamic_events
> $ echo 1 > events/kprobes/enable
> Unable to handle kernel paging request at virtual address 0000000200000128
> ...
> [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
> [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
> [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
> [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
> [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
> [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
> [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
> [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
> [<ffffffff8067872a>] tty_write+0x1a/0x30
> 
> In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
> 
> arch_rethook_trampoline saves the registers from the probed function in a
> struct pt_regs. sp is not saved. Instead, sp is decremented for
> arch_rethook_trampoline's local stack.
> 
> Fix this crash and save the original sp along with the other registers.
> Use a0 as a temporary register, it is overwritten anyway.

Good catch!

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

I would like this to be handled by the RISC-V maintainers.

Thank you,

> 
> Signed-off-by: Martin Kaiser <martin@kaiser.cx>
> ---
>  arch/riscv/kernel/probes/rethook_trampoline.S | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/riscv/kernel/probes/rethook_trampoline.S b/arch/riscv/kernel/probes/rethook_trampoline.S
> index f2cd83d9b0f0..c3aa8d8cf5af 100644
> --- a/arch/riscv/kernel/probes/rethook_trampoline.S
> +++ b/arch/riscv/kernel/probes/rethook_trampoline.S
> @@ -41,6 +41,9 @@
>  	REG_S x29, PT_T4(sp)
>  	REG_S x30, PT_T5(sp)
>  	REG_S x31, PT_T6(sp)
> +	/* save original sp */
> +	addi a0, sp, PT_SIZE_ON_STACK
> +	REG_S a0, PT_SP(sp)
>  	.endm
>  
>  	.macro restore_all_base_regs
> -- 
> 2.43.7
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH] riscv: probes: save original sp in rethook trampoline

[Paul Walmsley]

On Wed, 1 Jul 2026, Masami Hiramatsu wrote:

> On Tue, 30 Jun 2026 21:40:03 +0200
> Martin Kaiser <martin@kaiser.cx> wrote:
> 
> > Reading a word from the stack in a kretprobe crashes a risc-v kernel.
> > 
> > $ cd /sys/kernel/tracing/
> > $ echo 'r n_tty_write $stack0' > dynamic_events
> > $ echo 1 > events/kprobes/enable
> > Unable to handle kernel paging request at virtual address 0000000200000128
> > ...
> > [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38
> > [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760
> > [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0
> > [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58
> > [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90
> > [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108
> > [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c
> > [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94
> > [<ffffffff8067872a>] tty_write+0x1a/0x30
> > 
> > In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
> > 
> > arch_rethook_trampoline saves the registers from the probed function in a
> > struct pt_regs. sp is not saved. Instead, sp is decremented for
> > arch_rethook_trampoline's local stack.
> > 
> > Fix this crash and save the original sp along with the other registers.
> > Use a0 as a temporary register, it is overwritten anyway.
> 
> Good catch!
> 
> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> I would like this to be handled by the RISC-V maintainers.

Thanks, added a Fixes: tag and cc'ed stable, and queued for v7.2-rc.


- Paul