Re: [PATCH v16 08/20] unwind_user: Stop when reaching an outermost frame

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added `outermost` field in `struct unwind_user_frame` is left uninitialized in `unwind_user_next_sframe()`, causing `unwind_user_next_common()` to read stack garbage and potentially terminate unwinding prematurely.
--

commit 88bb99c2143c88573eb3287429d12baa8f4ccda7
Author: Jens Remus <jremus@linux.ibm.com>

unwind_user: Stop when reaching an outermost frame

This commit adds an indication for an outermost frame to the unwind user
frame structure. It updates the common user unwinding code to stop when
such a frame is encountered.

[ ... ]

> diff --git a/kernel/unwind/user.c b/kernel/unwind/user.c
> index 1fb2724197332..fdb1001e37505 100644
> --- a/kernel/unwind/user.c
> +++ b/kernel/unwind/user.c
> @@ -32,6 +32,12 @@ static int unwind_user_next_common(struct unwind_user_state *state,
>  {
>  	unsigned long cfa, fp, ra;
>  
> +	/* Stop unwinding when reaching an outermost frame. */
> +	if (frame->outermost) {

[Severity: Medium]
Could this read uninitialized stack memory during bisection?

In unwind_user_next_sframe(), struct unwind_user_frame frame is declared
on the stack without being fully zeroed. It then calls __find_fre() which
populates only some fields, leaving the new outermost field uninitialized:

unwind_user_next_sframe()
   struct unwind_user_frame frame;
   
   __find_fre()
      /* populates cfa_off, ra_off, fp_off, use_fp */

   unwind_user_next_common()
      if (frame->outermost) { /* reads uninitialized stack memory */

If the stack memory happens to be non-zero, this could incorrectly set
state->done = true and truncate the stack trace prematurely.

While this appears to be resolved in the subsequent commit
"unwind_user/sframe: Add support for outermost frame indication", does
introducing the read here before the initialization break bisectability?

> +		state->done = true;
> +		return 0;
> +	}
> +
>  	/* Get the Canonical Frame Address (CFA) */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521142546.3908498-1-jremus@linux.ibm.com?part=8