On Mon, 6 Jul 2026 08:36:48 +0000
Pu Hu <[email protected]> wrote:

> From: Pu Hu <[email protected]>
> 
> kprobe_fault_handler() handles faults taken while kprobes is in
> KPROBE_HIT_SS or KPROBE_REENTER state as faults caused by the
> single-stepped instruction.
> 
> That assumption is not always true. While a kprobe is preparing or
> executing the out-of-line single-step instruction, other code may run
> in that window. For example, perf or trace code can be invoked from the
> debug exception path and may take a fault of its own. In that case the
> fault did not happen on the kprobe XOL instruction, but the kprobe fault
> handler may still try to recover it as a kprobe single-step fault.
> 
> This can corrupt the exception recovery flow and leave the real fault to
> be handled with a wrong PC. A typical reproducer is running simpleperf
> with preemptirq tracepoints and dwarf callchains while a kprobe is
> installed on a frequently executed kernel function.
> 
> Fix this by handling faults in KPROBE_HIT_SS/KPROBE_REENTER only when
> the faulting PC points at the current kprobe's XOL instruction. Faults
> from any other PC are left to the normal fault handling path.
> 
> This follows the same idea as the x86 fix in commit 6381c24cd6d5
> ("kprobes/x86: Fix page-fault handling logic").
> 
> Signed-off-by: Pu Hu <[email protected]>
> Signed-off-by: Hongyan Xia <[email protected]>
> ---
>  arch/arm64/kernel/probes/kprobes.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/arch/arm64/kernel/probes/kprobes.c 
> b/arch/arm64/kernel/probes/kprobes.c
> index 43a0361a8bf0..e4d2852ce2fb 100644
> --- a/arch/arm64/kernel/probes/kprobes.c
> +++ b/arch/arm64/kernel/probes/kprobes.c
> @@ -285,6 +285,20 @@ int __kprobes kprobe_fault_handler(struct pt_regs *regs, 
> unsigned int fsr)
>       switch (kcb->kprobe_status) {
>       case KPROBE_HIT_SS:
>       case KPROBE_REENTER:
> +             /*
> +              * A fault taken while a kprobe is single-stepping is not
> +              * necessarily caused by the instruction in the XOL slot. For
> +              * example, tracing or perf code running in this window may take
> +              * an unrelated fault.
> +              *
> +              * Handle the fault here only when the faulting PC is the XOL
> +              * instruction of the current kprobe. Otherwise let the normal
> +              * fault handling path deal with it.
> +              */
> +             if (cur->ainsn.xol_insn &&
> +                     instruction_pointer(regs) != (unsigned 
> long)cur->ainsn.xol_insn)
> +                     break;

Can you check Sashiko's comments[1]?

[1] 
https://sashiko.dev/#/patchset/20260706083636.159883-1-hupu%40transsion.com?part=1

It seems that it complains about simulated kprobe's case.
In that case, cur->ainsn.xol_insn == NULL. The simulation should be done
in the kprobe context (which is a debug trap). I'm not sure the arm64
can cause NMI in that context, but if it happens and causes a fault,
it may cause a problem.

So I think we can just ignore the fault on the simulated kprobes.

To ensure that, you can just add:

        if (cur && !cur->ainsn.xol_insn)
                return 0;

at the entry of this function. (and remove redundant cur->ainsn.xol_insn check)

Thank you,

> +
>               /*
>                * We are here because the instruction being single
>                * stepped caused a page fault. We reset the current
> -- 
> 2.43.0
> 


-- 
Masami Hiramatsu (Google) <[email protected]>

Reply via email to