Re: [PATCH v3 1/2] riscv: kprobes: fix out-of-bounds read in riscv_probe_decode_insn

[Guo Ren]

On Thu, Nov 12, 2026 at 6:02 PM Vladimir Kondratiev
<vladimir.kondratiev@xxxxxxxxxxxx> wrote:
>
> riscv_probe_decode_insn() can trigger an out-of-bounds page fault
> when probing a 16-bit compressed instruction at the end of a page.
>
> arch_prepare_kprobe() safely reads 16-bit parcels into p->opcode, but then
> passes p->addr to riscv_probe_decode_insn(), which unconditionally
> dereferences *addr as a 32-bit probe_opcode_t
>
> If a 16-bit instruction sits in the last two bytes of a mapped page next
> to an unmapped page, the 32-bit read of *addr crosses the page boundary
> and faults.
>
> Passing &p->opcode instead of p->addr to riscv_probe_decode_insn()
> (as arch_uprobe_analyze_insn() already does) avoid reading past the
> instruction.
>
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-812af091-20d1-4915-97a6-741f51e07022
> Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")
> Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@xxxxxxxxxxxx>
> ---
>  arch/riscv/kernel/probes/kprobes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
> index 9e2afabf94e8..63ee5066def5 100644
> --- a/arch/riscv/kernel/probes/kprobes.c
> +++ b/arch/riscv/kernel/probes/kprobes.c
> @@ -85,7 +85,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
>                 p->opcode |= (kprobe_opcode_t)(*insn) << 16;
>
>         /* decode instruction */
> -       switch (riscv_probe_decode_insn(p->addr, &p->ainsn.api)) {
> +       switch (riscv_probe_decode_insn(&p->opcode, &p->ainsn.api)) {
Yes, using &p->opcode is correct.

Reviewed-by: GUO Ren (XuanTie) <guoren@xxxxxxxxxx>

-- 
Best Regards
 GUO Ren