Re: [PATCH v4 2/3] riscv: probes: reject probes inside an LR/SC sequence

[kernel test robot <lkp@intel.com>]

Hi Vladimir,

kernel test robot noticed the following build warnings:

[auto build test WARNING on c03c1a14507dfaf8b856c2608f9ac216021fc222]

url:    https://github.com/intel-lab-lkp/linux/commits/Vladimir-Kondratiev/riscv-kprobes-fix-out-of-bounds-read-in-riscv_probe_decode_insn/20261115-143733
base:   c03c1a14507dfaf8b856c2608f9ac216021fc222
patch link:    https://lore.kernel.org/r/20261115-probes-in-lrsc-v4-2-48b9b036bd1d%40mobileye.com
patch subject: [PATCH v4 2/3] riscv: probes: reject probes inside an LR/SC sequence
config: riscv-randconfig-1000-20261115 (https://download.01.org/0day-ci/archive/20261116/202611160252.d58noD11-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project ca14e3d05c4e63d6e8103945c86b958ed2f55d5f)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261116/202611160252.d58noD11-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611160252.d58noD11-lkp@intel.com/

All warnings (new ones prefixed by >>):

   In file included from arch/riscv/kernel/probes/kprobes.c:5:
   In file included from include/linux/kprobes.h:28:
   In file included from include/linux/ftrace.h:10:
   In file included from include/linux/trace_recursion.h:5:
   In file included from include/linux/interrupt.h:11:
   In file included from include/linux/hardirq.h:11:
   In file included from ./arch/riscv/include/generated/asm/hardirq.h:1:
   In file included from include/asm-generic/hardirq.h:17:
   In file included from include/linux/irq.h:20:
   In file included from include/linux/io.h:12:
   In file included from arch/riscv/include/asm/io.h:148:
   include/asm-generic/io.h:1209:55: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
    1209 |         return (port > MMIO_UPPER_LIMIT) ? NULL : PCI_IOBASE + port;
         |                                                   ~~~~~~~~~~ ^
>> arch/riscv/kernel/probes/kprobes.c:75:4: warning: add explicit braces to avoid dangling else [-Wdangling-else]
      75 |                         else
         |                         ^
   2 warnings generated.


vim +75 arch/riscv/kernel/probes/kprobes.c

    51	
    52	/*
    53	 * Walk the instructions from the enclosing symbol up to addr to check that
    54	 * addr is an instruction boundary. Then reject a probe inside an LR/SC
    55	 * sequence: the breakpoint trap drops the reservation, so the SC would fail
    56	 * and the loop would hit the probe again on every retry. The sequence is
    57	 * recognised by a forward scan with the constrained-sequence rules, as for
    58	 * uprobes, so an lr that is not followed by an sc (as in __cmpwait()) does
    59	 * not taint the rest of the function.
    60	 */
    61	static int __kprobes arch_check_kprobe(unsigned long addr)
    62	{
    63		unsigned long tmp, offset;
    64	
    65		/* start iterating at the closest preceding symbol */
    66		if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
    67			return -EILSEQ;
    68	
    69		tmp = addr - offset;
    70	
    71		while (tmp <= addr) {
    72			if (tmp == addr)
    73				if (riscv_probe_in_lrsc_body((u16 *)addr, RISCV_LRSC_SCAN_BYTES))
    74					return -EINVAL;
  > 75				else
    76					return 0;
    77	
    78			tmp += GET_INSN_LENGTH(*(u16 *)tmp);
    79		}
    80	
    81		return -EILSEQ;
    82	}
    83	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki