From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DE5335AC3E for ; Mon, 2 Mar 2026 10:53:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772448837; cv=none; b=nbRsqZwCZ5yOUH+7vKjKsmN1xcpO0xs/a1mXO9QU87dvJuxixTdrTmGFEmGnQLhYRooTJGZ8eYS0W/xJxJdZ0ioeUEULv67+qfcZ2PjWegvSoOVElpgO4/LvRoWJaVEp0bBhqDdxVMbBeHrf27dCd1CDOS70EXcUpuKQ3yXy6xg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772448837; c=relaxed/simple; bh=z48fVF0lJd2GDvLDQs+NfzoACzQIrm9lC8rVn6midEA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=uk5iMxjP3756U0fFV7cgzVP+/zdfzkluj22oypmRt/49Pgq5UJ++zfDVFKoLJAN1jPKYP6ETXJbEkHpoLaEPHJXQqtszHPsSBhYYSFvYr46Iv4MLJT27PMsd7Z09lE/iDjAoaISBnQyXM3zwJ7yVfiynBjAJlgs7IzlAYTXXdSY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=BjIwmnOF; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=jiiUe/kk; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="BjIwmnOF"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="jiiUe/kk" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62294n3T1291535 for ; Mon, 2 Mar 2026 10:53:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=zzJN+64IcS+ RyJd/VgnL88SzR2FVDldBCnYxEzN1kLw=; b=BjIwmnOF5xH6xDd6eec+v1itiva 8gnAHGqfa7HB9TOX23fumeeEu7x9LkhVITQSlqnTzVPwZhgi865T2adIbcCQ8gg2 bvk32JfgLwmqX91mz2TDszeV38RhsWqdEHu/AOQhXN4AmRBt2ETskS1bzH42BbA1 aAFCksAcoSFF1j+cqLERlkHmKDgYDlnXfabpW3vdg7X+sXeD+H7Ov21JBjOdlulX zvh65MAyoFtH3xuMmv9A1ZQu+A1RIedG+mivrSd1Me1g7w7pRDmqRz4FKwpnbvMG VpwrEs/ZkhQ6OrTjKbC3obKp738lJL9YzF6NclqAHaioIGHQP8FHq8EZx6w== Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cn7ku0ct8-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 02 Mar 2026 10:53:54 +0000 (GMT) Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-c70ea2f7d1bso2830778a12.2 for ; Mon, 02 Mar 2026 02:53:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1772448834; x=1773053634; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=zzJN+64IcS+RyJd/VgnL88SzR2FVDldBCnYxEzN1kLw=; b=jiiUe/kkZvjUMt5M7UvWhts2HjLlaJFEx456ap4CBvz+V8Zw+F6ezQ817um7FRS4QD cHaODCD7WF6+BBr2ohpP2kkIVmCFA1mcrWf/Eqw/md2lKg4TytPux404/wTxOSVMahG9 6w1x88Rs0LpDIQ0x5bAJn18wpNyZHX9gNpOuU23TqwK50xA0fwX+jHeG8cvvYTQWyotr fxX7ppo2qOlO1jGQbqv87fPwVDnmRpPmX8cBzCujVzbRC4zgocTPYXiEQykzphaVHrtN 4769Bj859BA6oKjmLwuJZY6FqAVC4eJBCzvUO/LWxn4D+BmWV2LyzScSasC5pYvw/Q2X wcvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772448834; x=1773053634; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=zzJN+64IcS+RyJd/VgnL88SzR2FVDldBCnYxEzN1kLw=; b=KprhaCi1km6ZEJFQEhQav7hW74pYAh/GNc7ouot+YD+P0rykIo9Q/460/nV/fgwoG0 rEUixo6NYEq41k2tNM74CxwWNqLqCK/F7MTWldhv71Pm+LeP5NPOodTAFfST9FBfObyc dgcNEpKqGLy6AARxC8nZTD16uaAHajkEpcM5Ru83zz3ezScm/ggMN1us1MbKMuUT0Wqp EMLtcJ/QWcKn2+1fz6uZ0vxeMmYXwn3YfeCnOUscNbTjuS9zh3e2whcqz0mYl9cqXXEt 69qRzEv+TaLhfpMKhhcCgpTFiF4VxouSce04LBzaEFOWuuHRWMQX08E2wcwhE9uQPHnS yQqw== X-Forwarded-Encrypted: i=1; AJvYcCWvx1lKZQjELkB/nQzz3TNGQnz80mzY2FzI2+Er1V4eocCk32pQlHOSK2gmKttugUqGTekzaH4FHzDcsKg=@vger.kernel.org X-Gm-Message-State: AOJu0Yx0+MborfNSefUZOHsMdDSjDKMHIB1G6Z8jfwMrLYAzFlOkmdZu Iy8oVOvNYDChI80DjSjiDeFcFm2BZiu54VDptrj6MK4BGJ2qQuqbSt8kerqmb1nF//0RgxFdAD0 nUT8A6pO5Em3GDsgRzEoJHH55uLLtxpr7mFdkC8cpqRcBkmsfqr83lqlzOHHo75C2TpjHLUOYAo U= X-Gm-Gg: ATEYQzyv5gbU0ZKC3yHdFqE6vjYRQq44FJQmXpdAmng/oY511u9teBO9pvTB6JYnMdO 9nWZ9/gdDaXqcT+CuiZFDc+2H6NfG0UEC4B5KyQAgPrFaKEJIJJ/QwheKYu+NWu6+Y+9WdzweV9 wExsGXFkZAHQ+HIbW6n0VxOe6ozyIdrmaFZsHFuEYYAJ7OOBY3yVYIPDrdtb3tmFEab76hZPYpy yV8puHMwPluUiHt19eAxgGHo50DFxUPWNN3dRhopat/HviYrlWXWbfslJ4b/+sDiV71fxygDS34 oyoBBn/NwkaHNwfTKG0pAWMVIfG5JErELtDAImqPaLyrZKKwHIjGFFNaBsqK/O2QPFeMvkLrIMQ 3mLokP7Ua4JY5vz5aKPltAt7BqjFa7V10wb6yBwnMkfFvsZF5OCH3 X-Received: by 2002:a05:6a20:d74a:b0:366:1880:7e06 with SMTP id adf61e73a8af0-395c372d14bmr10504462637.0.1772448833903; Mon, 02 Mar 2026 02:53:53 -0800 (PST) X-Received: by 2002:a05:6a20:d74a:b0:366:1880:7e06 with SMTP id adf61e73a8af0-395c372d14bmr10504442637.0.1772448833428; Mon, 02 Mar 2026 02:53:53 -0800 (PST) Received: from hu-kshaikkh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c70fa632ddesm11847479a12.13.2026.03.02.02.53.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Mar 2026 02:53:52 -0800 (PST) From: Khaja Hussain Shaik Khaji To: mark.rutland@arm.com Cc: ada.coupriediaz@arm.com, catalin.marinas@arm.com, dev.jain@arm.com, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, mhiramat@kernel.org, will@kernel.org, yang@os.amperecomputing.com Subject: [PATCH v3 0/1] kernel: kprobes: fix cur_kprobe corruption during Date: Mon, 2 Mar 2026 16:23:46 +0530 Message-Id: <20260302105347.3602192-1-khaja.khaji@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=V4NwEOni c=1 sm=1 tr=0 ts=69a56c43 cx=c_pps a=rz3CxIlbcmazkYymdCej/Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=Yq5XynenixoA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=BfyKfM7flnzB51c3jB0A:9 a=bFCP_H2QrGi7Okbo017w:22 X-Proofpoint-GUID: GHDjKjdloOPfgr801RXn63BgWu4Pkoqo X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzAyMDA4OCBTYWx0ZWRfXw5BdyqH0X438 RTp3G2FeCYO2ptlHv39LIW9xxj+nXbP9ZnEgCdtXkFnTPftPUIV+ZMwHVG07hO7YpV/p8hCaZuv vR553w+rKi0GlwZdiKTjYYBNMLKdBKYimI8iWiKQF3u+ll0EogIo7NsoLx0iYqvSKz6+auf+LSh Ren8pYZ0StNFnvmDhbNUeO/LvMmDbnIsH46pu06x/lUsFgdGvQcgx96DaLsYwWACXSRKDxEODg7 hr7cgDzF+JiZ6ELaYVVYmRTnxYehLSo7pGMy0EJdRtb3Vt1WEj5nVA9ukYZPCTQUb2AeT8d27Dy bCLNu9xtuwisHliiexi1LxQ/7KYFK2I5P2JarUk0lcDmMCIXptA+hmYo/YGVkDIjFWnImTyqsGb Vul/d3INxJant1FTWJrKxSXduPevKgSrGtWLRLfjZzkv6weIOuPR517WBdH99Jsjbol8Za9E4b8 6lM52iXmbmWLkpTkJfA== X-Proofpoint-ORIG-GUID: GHDjKjdloOPfgr801RXn63BgWu4Pkoqo X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-02_03,2026-02-27_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 malwarescore=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 bulkscore=0 spamscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2602130000 definitions=main-2603020088 This patch fixes a kprobes failure observed due to lost current_kprobe on arm64 during kretprobe entry handling under interrupt load. v1 attempted to address this by simulating BTI instructions as NOPs and v2 attempted to address this by disabling preemption across the out-of-line (XOL) execution window. Further analysis showed that this hypothesis was incorrect: the failure is not caused by scheduling or preemption during XOL. The actual root cause is re-entrant invocation of kprobe_busy_begin() from an active kprobe context. On arm64, IRQs are re-enabled before invoking kprobe handlers, allowing an interrupt during kretprobe entry_handler to trigger kprobe_flush_task(), which calls kprobe_busy_begin/end and corrupts current_kprobe and kprobe_status. [ 2280.630526] Call trace: [ 2280.633044] dump_backtrace+0x104/0x14c [ 2280.636985] show_stack+0x20/0x30 [ 2280.640390] dump_stack_lvl+0x58/0x74 [ 2280.644154] dump_stack+0x20/0x30 [ 2280.647562] kprobe_busy_begin+0xec/0xf0 [ 2280.651593] kprobe_flush_task+0x2c/0x60 [ 2280.655624] delayed_put_task_struct+0x2c/0x124 [ 2280.660282] rcu_core+0x56c/0x984 [ 2280.663695] rcu_core_si+0x18/0x28 [ 2280.667189] handle_softirqs+0x160/0x30c [ 2280.671220] __do_softirq+0x1c/0x2c [ 2280.674807] ____do_softirq+0x18/0x28 [ 2280.678569] call_on_irq_stack+0x48/0x88 [ 2280.682599] do_softirq_own_stack+0x24/0x34 [ 2280.686900] irq_exit_rcu+0x5c/0xbc [ 2280.690489] el1_interrupt+0x40/0x60 [ 2280.694167] el1h_64_irq_handler+0x20/0x30 [ 2280.698372] el1h_64_irq+0x64/0x68 [ 2280.701872] _raw_spin_unlock_irq+0x14/0x54 [ 2280.706173] dwc3_msm_notify_event+0x6e8/0xbe8 [ 2280.710743] entry_dwc3_gadget_pullup+0x3c/0x6c [ 2280.715393] pre_handler_kretprobe+0x1cc/0x304 [ 2280.719956] kprobe_breakpoint_handler+0x1b0/0x388 [ 2280.724878] brk_handler+0x8c/0x128 [ 2280.728464] do_debug_exception+0x94/0x120 [ 2280.732670] el1_dbg+0x60/0x7c [ 2280.735815] el1h_64_sync_handler+0x48/0xb8 [ 2280.740114] el1h_64_sync+0x64/0x68 [ 2280.743701] dwc3_gadget_pullup+0x0/0x124 [ 2280.747827] soft_connect_store+0xb4/0x15c [ 2280.752031] dev_attr_store+0x20/0x38 [ 2280.755798] sysfs_kf_write+0x44/0x5c [ 2280.759564] kernfs_fop_write_iter+0xf4/0x198 [ 2280.764033] vfs_write+0x1d0/0x2b0 [ 2280.767529] ksys_write+0x80/0xf0 [ 2280.770940] __arm64_sys_write+0x24/0x34 [ 2280.774974] invoke_syscall+0x54/0x118 [ 2280.778822] el0_svc_common+0xb4/0xe8 [ 2280.782587] do_el0_svc+0x24/0x34 [ 2280.785999] el0_svc+0x40/0xa4 [ 2280.789140] el0t_64_sync_handler+0x8c/0x108 [ 2280.793526] el0t_64_sync+0x198/0x19c This v3 patch makes kprobe_busy_begin/end re-entrant safe by preserving the active kprobe state using a per-CPU depth counter and saved state. The detailed failure analysis and justification are included in the commit message. Changes since v2: - Dropped the scheduling/preemption-based approach. - Identified the re-entrant kprobe_busy_begin() root cause. - Fixed kprobe_busy_begin/end to preserve active kprobe state. - Link to v2: https://lore.kernel.org/all/20260217133855.3142192-2-khaja.khaji@oss.qualcomm.com/ Khaja Hussain Shaik Khaji (1): kernel: kprobes: fix cur_kprobe corruption during re-entrant kprobe_busy_begin() calls kernel/kprobes.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) -- 2.34.1