[PATCH 0/2] Fix issues in LoongArch page fault handling

[PATCH 0/2] Fix issues in LoongArch page fault handling

[Lorenz Hetterich]

This patch series addresses two issues in LoongArch page fault handling.

First, the page fault handler calls kprobe_page_fault
with the current thread's trap_nr.
However, the thread's trap number is not updated prior
to the call leading to a stale value being used.

Second, the page fault handler never sets the FAULT_FLAG_INSTRUCTION flag.
This means architecture-independent linux code like
handle_mm_fault cannot distinguish between read and execute faults.
While this does not seem to cause immediate problems,
it is inconsistent with other architectures like x86, arm64, and riscv.

Signed-off-by: Lorenz Hetterich <lorenz.hetterich@cispa.de>

Lorenz Hetterich (2):
  Loongarch: Fix stale value in __do_page_fault()
  LoongArch: Set FAULT_FLAG_INSTRUCTION in __do_page_fault()

 arch/loongarch/include/asm/exception.h | 3 +++
 arch/loongarch/mm/fault.c              | 4 ++++
 2 files changed, 7 insertions(+)

-- 
2.43.0

[PATCH 1/2] Loongarch: Fix stale value in __do_page_fault()

[Lorenz Hetterich]

__do_page_fault() calls kprobe_page_fault without setting
current->thread.trap_nr first.
Hence, kprobe_page_fault is called with a stale trapnr.

Set current->thread.trap_nr before calling kprobe_page_fault.

Signed-off-by: Lorenz Hetterich <lorenz.hetterich@cispa.de>
---
 arch/loongarch/mm/fault.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/loongarch/mm/fault.c b/arch/loongarch/mm/fault.c
index 2c93d33356e5..c7703bdec4fc 100644
--- a/arch/loongarch/mm/fault.c
+++ b/arch/loongarch/mm/fault.c
@@ -182,6 +182,7 @@ static void __kprobes __do_page_fault(struct pt_regs *regs,
 	struct vm_area_struct *vma = NULL;
 	vm_fault_t fault;
 
+	current->thread.trap_nr = read_csr_excode();
 	if (kprobe_page_fault(regs, current->thread.trap_nr))
 		return;
 
-- 
2.43.0

Re: [PATCH 1/2] Loongarch: Fix stale value in __do_page_fault()

[Huacai Chen]

Hi, Lorenz,

On Wed, Mar 18, 2026 at 11:18 PM Lorenz Hetterich
<lorenz.hetterich@cispa.de> wrote:
>
> __do_page_fault() calls kprobe_page_fault without setting
> current->thread.trap_nr first.
> Hence, kprobe_page_fault is called with a stale trapnr.
>
> Set current->thread.trap_nr before calling kprobe_page_fault.
>
> Signed-off-by: Lorenz Hetterich <lorenz.hetterich@cispa.de>
> ---
>  arch/loongarch/mm/fault.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/arch/loongarch/mm/fault.c b/arch/loongarch/mm/fault.c
> index 2c93d33356e5..c7703bdec4fc 100644
> --- a/arch/loongarch/mm/fault.c
> +++ b/arch/loongarch/mm/fault.c
> @@ -182,6 +182,7 @@ static void __kprobes __do_page_fault(struct pt_regs *regs,
>         struct vm_area_struct *vma = NULL;
>         vm_fault_t fault;
>
> +       current->thread.trap_nr = read_csr_excode();
>         if (kprobe_page_fault(regs, current->thread.trap_nr))
>                 return;
kprobe_page_fault() doesn't really use trap_nr, but this doesn't mean
this patch is useless, at least the second patch need this one.

But you can remove "current->thread.trap_nr = read_csr_excode()" in
do_sigbus() and do_sigsegv() at the same time.


Huacai

>
> --
> 2.43.0
>

[PATCH 2/2] LoongArch: Set FAULT_FLAG_INSTRUCTION in __do_page_fault()

[Lorenz Hetterich]

The page-fault handler never sets the FAULT_FLAG_INSTRUCTION flag.

Set FAULT_FLAG_INSTRUCTION for faults related to instruction fetches.

Signed-off-by: Lorenz Hetterich <lorenz.hetterich@cispa.de>
---
 arch/loongarch/include/asm/exception.h | 3 +++
 arch/loongarch/mm/fault.c              | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/arch/loongarch/include/asm/exception.h b/arch/loongarch/include/asm/exception.h
index c6d20736fd92..7305b7065a43 100644
--- a/arch/loongarch/include/asm/exception.h
+++ b/arch/loongarch/include/asm/exception.h
@@ -6,6 +6,9 @@
 #include <asm/ptrace.h>
 #include <linux/kprobes.h>
 
+#define EXC_PIF	3  /* Page Invalid Fetch */
+#define EXC_PNX	6  /* Page Non-eXecutable */
+
 extern void *exception_table[];
 
 void show_registers(struct pt_regs *regs);
diff --git a/arch/loongarch/mm/fault.c b/arch/loongarch/mm/fault.c
index c7703bdec4fc..7cd422c1224e 100644
--- a/arch/loongarch/mm/fault.c
+++ b/arch/loongarch/mm/fault.c
@@ -215,6 +215,9 @@ static void __kprobes __do_page_fault(struct pt_regs *regs,
 	if (user_mode(regs))
 		flags |= FAULT_FLAG_USER;
 
+	if (current->thread.trap_nr == EXC_PIF || current->thread.trap_nr == EXC_PNX)
+		flags |= FAULT_FLAG_INSTRUCTION;
+
 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
 
 	if (!(flags & FAULT_FLAG_USER))
-- 
2.43.0

Re: [PATCH 2/2] LoongArch: Set FAULT_FLAG_INSTRUCTION in __do_page_fault()

[Huacai Chen]

Hi, Lorenz,

On Wed, Mar 18, 2026 at 11:18 PM Lorenz Hetterich
<lorenz.hetterich@cispa.de> wrote:
>
> The page-fault handler never sets the FAULT_FLAG_INSTRUCTION flag.
>
> Set FAULT_FLAG_INSTRUCTION for faults related to instruction fetches.
>
> Signed-off-by: Lorenz Hetterich <lorenz.hetterich@cispa.de>
> ---
>  arch/loongarch/include/asm/exception.h | 3 +++
>  arch/loongarch/mm/fault.c              | 3 +++
>  2 files changed, 6 insertions(+)
>
> diff --git a/arch/loongarch/include/asm/exception.h b/arch/loongarch/include/asm/exception.h
> index c6d20736fd92..7305b7065a43 100644
> --- a/arch/loongarch/include/asm/exception.h
> +++ b/arch/loongarch/include/asm/exception.h
> @@ -6,6 +6,9 @@
>  #include <asm/ptrace.h>
>  #include <linux/kprobes.h>
>
> +#define EXC_PIF        3  /* Page Invalid Fetch */
> +#define EXC_PNX        6  /* Page Non-eXecutable */
Needn't, you can use EXCCODE_TLBI/EXCCODE_TLBNX in loongarch.h directly.


Huacai

> +
>  extern void *exception_table[];
>
>  void show_registers(struct pt_regs *regs);
> diff --git a/arch/loongarch/mm/fault.c b/arch/loongarch/mm/fault.c
> index c7703bdec4fc..7cd422c1224e 100644
> --- a/arch/loongarch/mm/fault.c
> +++ b/arch/loongarch/mm/fault.c
> @@ -215,6 +215,9 @@ static void __kprobes __do_page_fault(struct pt_regs *regs,
>         if (user_mode(regs))
>                 flags |= FAULT_FLAG_USER;
>
> +       if (current->thread.trap_nr == EXC_PIF || current->thread.trap_nr == EXC_PNX)
> +               flags |= FAULT_FLAG_INSTRUCTION;
> +
>         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
>
>         if (!(flags & FAULT_FLAG_USER))
> --
> 2.43.0
>