From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A595242D84 for ; Mon, 20 Apr 2026 07:06:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776668762; cv=none; b=Q6zbj3PH0KDncCIqjcaaYY68ixdXXfG7i7UPAEDs2nctql/dMmVC6maCws2HaBgMp9xTVejCIvCmyzwx3RZDp3RJeZrHQFIuGGBqdF+Kf7YjgIIcC7lqTSU31b7o1C7rvihtCGxJLIrDdnuLDAr31yXbARzCTSSM/EUF3VSY+/w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776668762; c=relaxed/simple; bh=Jw7mDwIsuIx+4zD17EmNypYWR9jmkfAruhwNtU2btpw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=c94t95s9H9Ut75x/PhCfN3HAhidvsJY+JEt45nl51XD/DDg2SDWFkAci1fRFrFrr7DohgUHHGih9Jlt/qUjOOxrJqU0LCk2QpfayqceUgfAwwPPTkR+a5Fr7Xu1oe4p928pC4fceSTF9NvUWZaNv3TyjiGL6D/CHnUrsHiK/VWc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=eKWnXsIt; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=I8wNsxuy; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="eKWnXsIt"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="I8wNsxuy" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 63JMpPOO921200 for ; Mon, 20 Apr 2026 07:06:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=GeJ6fpnU969 i6/hRfUoKXDZEOqk6TsNNPMvVeYit3yA=; b=eKWnXsIt6aab9IgZjzG1PRrEM5M 9UL7nrrqMsm/z0o24MzL6sR6D7XNVZzUexVXulQcwDMgIpXZ73l6NXZcc2pElH4u TpstcQrf7W60wGSdmdJznejNXVpMN1vER8IFK89lUwzxWAj1OBVUgGaHWYTXtqjR icnVtROKVgqUBxf6U7dquVjFkSxYYi3zZt9g4NhiFzLF14Ug5xYP4fM0syObP+zh x7qAqlZlDREflksgbZf8dU2jlRLEkalcKO6b5b5PZhf8jPxnZqXwKrVqsRlI/bgH jwZKEGrilZT1fJNAIlfIy3jl6KeTq0f4XuV0C3xqLGhNF3xFyKwl0OQBfAQ== Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4dm1hx4k7s-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 20 Apr 2026 07:05:59 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-82fa860e71eso575625b3a.0 for ; Mon, 20 Apr 2026 00:05:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1776668759; x=1777273559; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=GeJ6fpnU969i6/hRfUoKXDZEOqk6TsNNPMvVeYit3yA=; b=I8wNsxuyuTF/mVyWbHVKo5k5uQvGqpHbNS1TguEq0sDLdM0gZ2UREDaYQNpRBqadRo 3QwuBhWePTyyWkt7Fm+cS1kDbr3JxA5mnrJH5jqQXUVUa5DWpdST5cmQvV0yfFlLlgVD 1WgjW9R5Bsm/vxNpNl7Z1Or3plY3wWQ+CRJgfoamcch6tLylQV4kn/berGC13tAFUY2I m9Jh/8ghxyedcgsBG0VttoURYrWrmtfIYr5e3FEkR+Zkf0k/e4J67ftvNge+E5UPQdjJ DKylkznQ/VV7OAtroLCsbmqKhQ8+wVAmyJuc4xZHhUaEx5FxkRcWNTWgEdVi2qNfG35K 0sSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776668759; x=1777273559; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=GeJ6fpnU969i6/hRfUoKXDZEOqk6TsNNPMvVeYit3yA=; b=PWF3eiaQSNJj9T80lL8EyVmn7E00MVUQgQJqdHS8xaog3dT5Hs6eM6XKRey7Am6OYb MAqgIfUuI7FHEdt13Pv0AkCv2xXg3R0g4+B3WIHru2cZgbZ9UA84B5SS8srYdUeEbeNw YJ9yngq5xlcuwjMUF4A+9jA6EiSZQKy+3zPgVZFzNc1hdibCmtpRAdno6b3L6lncGL+r ntYwBoYo/DWd6hYu+UHhCR7bE/0m8C3oJDlidcuWHLcamRzilhqwZKT/szlp+qwxADPA gvt7o4zwndnBNc1X2VLa9cCgwQOLS1Kc/fvCXvWIsXZE/GgN3VAp3kIWHakdL8bSduH3 JfHA== X-Gm-Message-State: AOJu0YwTqfRE00DDL/jqJb5mGUtTYOEcuwlCDSSWMbqeVMUh10McH26t ctPx79L3I3AEjcJyuBtPhxJBHMB6syo4rAAPe5UqQhC73r1FIW1cbTrtRJOX3cfkQ3H2YiZms3b 3WZP5wj6SH3yYmtiVyS2/xROvN4t949Yho7TJEHnvJPLNPlmlsmbqeHl30LLs9d7RE+I= X-Gm-Gg: AeBDieu4xZ5t91J7++/GDif2mOIVRfZXIRCt7VLNV0mew7K2IoPa+BoKIZA+Hok/uED opRfa9fCyLGCkRFcdc/oyqOZUea0dYewDpUZ/ia48XKQpllfQciQ0SQfy/gb4ftzrvWefqnKhqN B9Y3sfVMXovlbd94MQuXoJSlfPHyFd7OY02ZB/nWwfIk3KKATMAywzrt0ejfttJB2jOD45Uikfb CmRJ9GCH+g6hMRLrOZxmSBvWj0DCQ3dPhrZQpDcmIU7sVZTGJpn4nG/fK+YlUr66GuVIXPjSCVP le45QibWg89wrrUm/J8xwc0cBIPmQt3r5IU5zDo8fAeRELpLZzB6Wo4F7wJSL97KoKRILV3cwiA aw8r4Wdxes7GRFgsK8hlugaf1tBvZr5WcAEDic6l89J8wajx8nN85RQ38lst63yw= X-Received: by 2002:a05:6a00:908a:b0:81f:9b4c:81c0 with SMTP id d2e1a72fcca58-82f8c90c380mr13948911b3a.41.1776668758662; Mon, 20 Apr 2026 00:05:58 -0700 (PDT) X-Received: by 2002:a05:6a00:908a:b0:81f:9b4c:81c0 with SMTP id d2e1a72fcca58-82f8c90c380mr13948884b3a.41.1776668758194; Mon, 20 Apr 2026 00:05:58 -0700 (PDT) Received: from hu-kshaikkh-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f8e9fcea9sm11751925b3a.23.2026.04.20.00.05.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Apr 2026 00:05:57 -0700 (PDT) From: Khaja Hussain Shaik Khaji To: mark.rutland@arm.com Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, mhiramat@kernel.org, will@kernel.org, catalin.marinas@arm.com, ada.coupriediaz@arm.com, dev.jain@arm.com, yang@os.amperecomputing.com Subject: Re: [PATCH v3 1/1] kernel: kprobes: fix cur_kprobe corruption during re-entrant kprobe_busy_begin() calls Date: Mon, 20 Apr 2026 12:35:52 +0530 Message-Id: <20260420070552.1747992-1-khaja.khaji@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-ORIG-GUID: JN21H_T6MFSlxh5zkeF5XvfhcTCm1Z_7 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDIwMDA2OCBTYWx0ZWRfX0spwBl7GwDnB XP0Kw6l4+Y1pgAR1I4kJeQMbBhsBH02CjXtx+uuyugoLilzrl+ZWFWZke6RK3El6o6lB91hK9e6 07vdRqJvyjWJaDo/B9zaYhkxIRe2i9MoZtaA20dHvSzd80fLJt3ycC31MklGocgtMrNuLSthFXi trtnd4vVh3MwNVmKz9xIYj6F/92wduid4ljt7oCUAeDgj35MKRtLSrz1IHdUnoTbiXv8ITmlZZR hT0T6QCbhKQ3nVafpSaxhr8T0ihLEgXF/W+EWwuWBrrVHEZ9CeaSF1VpUPQfmbr5ItM2vm2zfW3 QECFUkNyXupark3YUIc0zSyUgQIbAYN/f2Z60guRWeSKeTOkzRlNdrUUFA0GPjiqDVinUhMoOjU 65lV+reqmbPL1G8+T1XZDB/hlOLslnl20W8hx8z1fZifuefOc4mMC/QllVtR4AE5c6EYQHp5SC5 tZQMrhskCuugmx3RJ4w== X-Proofpoint-GUID: JN21H_T6MFSlxh5zkeF5XvfhcTCm1Z_7 X-Authority-Analysis: v=2.4 cv=RoX16imK c=1 sm=1 tr=0 ts=69e5d057 cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=CdHHS4RwY1IrjTjwd6gA:9 a=OpyuDcXvxspvyRM73sMx:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-20_01,2026-04-17_04,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 adultscore=0 spamscore=0 phishscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2604070000 definitions=main-2604200068 On Mon, Mar 02, 2026 at 01:38:35PM +0000, Mark Rutland wrote: > That suggests that something is going wrong *within* your entry handler > that causes IRQs to be unmasked unexpectedly. > > Please can we find out *exactly* where IRQs get unmasked for the first > time? Thanks for the pointer -- that was the right direction to look. You are correct. I confirmed that arm64_enter_el1_dbg() does NOT re-enable IRQs; it only manages lockdep and context-tracking state. The IRQ unmask originates entirely within our kretprobe entry_handler itself. The exact call chain is: pre_handler_kretprobe() entry_dwc3_gadget_pullup() <- kretprobe entry_handler dwc3_msm_notify_event() _raw_spin_unlock_irq() <- first IRQ unmask (spin_unlock_irq) dwc3_msm_notify_event() is called from within the entry_handler while holding a spinlock acquired with spin_lock_irq() (i.e. IRQs were disabled on lock, and re-enabled unconditionally on unlock via spin_unlock_irq / _raw_spin_unlock_irq). This is the first point at which IRQs become unmasked. >From that point, a hardware IRQ fires, softirq processing runs, and kprobe_flush_task() -> kprobe_busy_begin()/end() is invoked while the kretprobe entry_handler is still on the stack -- triggering the cur_kprobe corruption described in the patch. Regarding documentation: the kprobes documentation in Documentation/trace/kprobes.rst (section "Kretprobe entry-handler") does not mention any restriction on enabling IRQs within an entry_handler. The only constraint documented is: "Probe handlers are run with preemption disabled or interrupt disabled, which depends on the architecture and optimization state." This is stated for kprobe/kretprobe handlers in general, but there is no explicit warning that an entry_handler must not re-enable IRQs for arm64. Given that entry_handlers are user-supplied callbacks, a note here would help future users avoid this class of bug. As for the fix itself: we plan to carry this as a downstream patch for our platform. We are not planning to push it upstream at this time. Thanks again for the detailed review. Khaja