On Wed, 1 Jul 2026, Masami Hiramatsu wrote: > On Tue, 30 Jun 2026 21:40:03 +0200 > Martin Kaiser <[email protected]> wrote: > > > Reading a word from the stack in a kretprobe crashes a risc-v kernel. > > > > $ cd /sys/kernel/tracing/ > > $ echo 'r n_tty_write $stack0' > dynamic_events > > $ echo 1 > events/kprobes/enable > > Unable to handle kernel paging request at virtual address 0000000200000128 > > ... > > [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 > > [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 > > [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 > > [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 > > [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 > > [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 > > [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c > > [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 > > [<ffffffff8067872a>] tty_write+0x1a/0x30 > > > > In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. > > > > arch_rethook_trampoline saves the registers from the probed function in a > > struct pt_regs. sp is not saved. Instead, sp is decremented for > > arch_rethook_trampoline's local stack. > > > > Fix this crash and save the original sp along with the other registers. > > Use a0 as a temporary register, it is overwritten anyway. > > Good catch! > > Acked-by: Masami Hiramatsu (Google) <[email protected]> > > I would like this to be handled by the RISC-V maintainers.
Thanks, added a Fixes: tag and cc'ed stable, and queued for v7.2-rc. - Paul
