CVE-2025-22069: riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler
In the Linux kernel, the following vulnerability has been resolved:
riscv: fgraph: Fix stack layout to match archftraceregs argument of ftracereturntohandler
Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftracestresstest.sh in riscv. We can reproduce the same issue with the following command:
$ cd /sys/kernel/debug/tracing $ echo 'f:myprobe donanosleep%return args1=$retval' > dynamicevents $ echo 1 > events/fprobes/enable $ echo 1 > tracingon $ sleep 1
And we can get the following kernel warning:
[ 127.692888] ------------[ cut here ]------------ [ 127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000 [ 127.693755] from func donanosleep return to ffffffff800ccb16 [ 127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftracereturntohandler+0x1b2/0x1be [ 127.699894] Modules linked in: [ 127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32 [ 127.701453] Hardware name: riscv-virtio,qemu (DT) [ 127.701859] epc : ftracereturntohandler+0x1b2/0x1be [ 127.702032] ra : ftracereturntohandler+0x1b2/0x1be [ 127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10 [ 127.702221] gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000 [ 127.702284] t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80 [ 127.702346] s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20 [ 127.702408] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 [ 127.702470] a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038 [ 127.702530] s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0 [ 127.702591] s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068 [ 127.702651] s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001 [ 127.702710] s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e [ 127.702769] t5 : ffffffff819d89a0 t6 : ff2000000065bb18 [ 127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003 [ 127.703292] [<ffffffff8013b5e0>] ftracereturntohandler+0x1b2/0x1be [ 127.703760] [<ffffffff80017bce>] returntohandler+0x16/0x26 [ 127.704009] [<ffffffff80017bb8>] returntohandler+0x0/0x26 [ 127.704057] [<ffffffff800d3352>] commonnsleep+0x42/0x54 [ 127.704117] [<ffffffff800d44a2>] riscvsysclocknanosleep+0xba/0x10a [ 127.704176] [<ffffffff80901c56>] dotrapecallu+0x188/0x218 [ 127.704295] [<ffffffff8090cc3e>] handleexception+0x14a/0x156 [ 127.705436] ---[ end trace 0000000000000000 ]---
The reason is that the stack layout for constructing argument for the ftracereturntohandler in the returntohandler does not match the archftraceregs structure of riscv, leading to unexpected results.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (ftrace fgraph / __arch_ftrace_regs)to a version that resolves this vulnerability.Patch riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler - Configuration
To avoid triggering the shown 'Bad frame pointer' warning while reproducing/mitigating, disable ftrace fprobes by setting /sys/kernel/debug/tracing/events/fprobes/enable to 0 instead of 1.
Linux ftrace (fprobes) events/fprobes/enable = 0 - Configuration
To avoid triggering the shown 'Bad frame pointer' warning while reproducing/mitigating, disable tracing by setting /sys/kernel/debug/tracing/tracing_on to 0 instead of 1.
Linux tracing tracing_on = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22069?
CVE-2025-22069 has not been assigned a specific severity rating yet, but it addresses a kernel warning issue related to stack layout.
How do I fix CVE-2025-22069?
To fix CVE-2025-22069, update your Linux kernel to the latest stable version containing the patch for this vulnerability.
What does CVE-2025-22069 impact?
CVE-2025-22069 impacts the Linux kernel on systems utilizing the riscv architecture.
Who reported the issue in CVE-2025-22069?
The issue in CVE-2025-22069 was reported by Naresh Kamboju.
When was CVE-2025-22069 resolved?
CVE-2025-22069 was resolved with updates made to the Linux kernel, though the exact resolution date is not specified.