arch/arm64/kernel/probes/kprobes.c:307 kprobe_fault_handler() error: we previously assumed 'cur' could be null (see line 292)

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Pu Hu <[email protected]>
CC: Will Deacon <[email protected]>
CC: Hongyan Xia <[email protected]>
CC: "Masami Hiramatsu (Google)" <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   0ce37745d4bfbc493f718169c3974898ffec8ee7
commit: 879a6754d3d11e30af24b7dc486f561510d62641 arm64: kprobes: Only handle faults originating from XOL slot
date:   9 days ago
:::::: branch date: 29 hours ago
:::::: commit date: 9 days ago
config: arm64-randconfig-r073-20260726 (https://download.01.org/0day-ci/archive/20260726/[email protected]/config)
compiler: aarch64-linux-gcc (GCC) 13.4.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 879a6754d3d1 ("arm64: kprobes: Only handle faults originating from XOL slot")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
arch/arm64/kernel/probes/kprobes.c:307 kprobe_fault_handler() error: we previously assumed 'cur' could be null (see line 292)

vim +/cur +307 arch/arm64/kernel/probes/kprobes.c

2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  279  
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  280  int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  281  {
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  282  	struct kprobe *cur = kprobe_running();
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  283  	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  284  
879a6754d3d11e Pu Hu           2026-07-10  285  	/*
879a6754d3d11e Pu Hu           2026-07-10  286  	 * Simulated kprobes execute in the debug trap context and have no
879a6754d3d11e Pu Hu           2026-07-10  287  	 * XOL slot. Any page fault taken while a simulated kprobe is in
879a6754d3d11e Pu Hu           2026-07-10  288  	 * progress cannot have been caused by kprobe single-stepping and
879a6754d3d11e Pu Hu           2026-07-10  289  	 * must be left alone for the normal page fault handler, including
879a6754d3d11e Pu Hu           2026-07-10  290  	 * fixup_exception.
879a6754d3d11e Pu Hu           2026-07-10  291  	 */
879a6754d3d11e Pu Hu           2026-07-10 @292  	if (cur && !cur->ainsn.xol_insn)
879a6754d3d11e Pu Hu           2026-07-10  293  		return 0;
879a6754d3d11e Pu Hu           2026-07-10  294  
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  295  	switch (kcb->kprobe_status) {
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  296  	case KPROBE_HIT_SS:
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  297  	case KPROBE_REENTER:
879a6754d3d11e Pu Hu           2026-07-10  298  		/*
879a6754d3d11e Pu Hu           2026-07-10  299  		 * A page fault taken while in KPROBE_HIT_SS or
879a6754d3d11e Pu Hu           2026-07-10  300  		 * KPROBE_REENTER state is only attributable to kprobe
879a6754d3d11e Pu Hu           2026-07-10  301  		 * single-stepping if the faulting PC points to the
879a6754d3d11e Pu Hu           2026-07-10  302  		 * current kprobe's XOL instruction. If the fault occurred
879a6754d3d11e Pu Hu           2026-07-10  303  		 * elsewhere (e.g. in perf or tracing code invoked from the
879a6754d3d11e Pu Hu           2026-07-10  304  		 * debug exception path), leave it for the normal page fault
879a6754d3d11e Pu Hu           2026-07-10  305  		 * handler to process.
879a6754d3d11e Pu Hu           2026-07-10  306  		 */
879a6754d3d11e Pu Hu           2026-07-10 @307  		if (instruction_pointer(regs) != (unsigned long)cur->ainsn.xol_insn)
879a6754d3d11e Pu Hu           2026-07-10  308  			break;
879a6754d3d11e Pu Hu           2026-07-10  309  
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  310  		/*
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  311  		 * We are here because the instruction being single
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  312  		 * stepped caused a page fault. We reset the current
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  313  		 * kprobe and the ip points back to the probe address
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  314  		 * and allow the page fault handler to continue as a
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  315  		 * normal page fault.
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  316  		 */
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  317  		instruction_pointer_set(regs, (unsigned long) cur->addr);
839157876f97fc zhouchuangao    2021-03-30  318  		BUG_ON(!instruction_pointer(regs));
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  319  
738fa58ee13284 Jisheng Zhang   2021-04-12  320  		if (kcb->kprobe_status == KPROBE_REENTER) {
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  321  			restore_previous_kprobe(kcb);
738fa58ee13284 Jisheng Zhang   2021-04-12  322  		} else {
738fa58ee13284 Jisheng Zhang   2021-04-12  323  			kprobes_restore_local_irqflag(kcb, regs);
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  324  			reset_current_kprobe();
738fa58ee13284 Jisheng Zhang   2021-04-12  325  		}
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  326  
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  327  		break;
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  328  	}
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  329  	return 0;
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  330  }
2dd0e8d2d2a157 Sandeepa Prabhu 2016-07-08  331  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki