Re: [PATCH v2 1/2] riscv: kprobes: fix out-of-bounds read in riscv_probe_decode_insn

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] riscv: kprobes: missing Fixes trailer for arch_prepare_kprobe()
  bug fix
--

commit 64462f82d964034abd78681cc277f651a87b8780
Author: Vladimir Kondratiev <vladimir.kondratiev@mobileye.com>

> riscv: kprobes: fix out-of-bounds read in riscv_probe_decode_insn
>
> riscv_probe_decode_insn() can trigger an out-of-bounds page fault
> when probing a 16-bit compressed instruction at the end of a page.
>
> arch_prepare_kprobe() safely reads 16-bit parcels into p->opcode, but then
> passes p->addr to riscv_probe_decode_insn(), which unconditionally
> dereferences *addr as a 32-bit probe_opcode_t
>
> If a 16-bit instruction sits in the last two bytes of a mapped page next
> to an unmapped page, the 32-bit read of *addr crosses the page boundary
> and faults.
>
> Passing &p->opcode instead of p->addr to riscv_probe_decode_insn()
> (as arch_uprobe_analyze_insn() already does) avoid reading past the
> instruction.
>
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-812af091-20d1-4915-97a6-741f51e07022
> Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@mobileye.com>

[Severity: Low]
Should this bug fix include a Fixes tag for the commit that introduced
the unguarded p->addr dereference in arch_prepare_kprobe()?

  Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-probes-in-lrsc-v2-0-b2525b7e1e8e@mobileye.com?part=1