Re: [RFC PATCH v2 08/24] unwind_user/eh_frame: Store .eh_frame_hdr section data in per-mm maple tree

[Jens Remus <jremus@linux.ibm.com>]

On 8/21/2026 10:13 PM, sashiko-bot@kernel.org wrote:

> This commit associates .eh_frame_hdr sections with their mm_struct by
> adding them to a per-mm maple tree. The tree is indexed by the
> corresponding text address ranges.

>> diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c

>> +static int __eh_frame_remove_section(struct ma_state *mas,
>> +				     struct eh_frame_section *sec)
>> +{
	struct eh_frame_section *erased;

	erased = mas_erase(mas);

>> +	if (mas_erase(mas) != sec) {

	if (mas_is_err(mas) || erased != sec) {

>> +		dbg("mas_erase failed: text=%lx\n", sec->text_start);
>> +		return -EINVAL;
>> +	}
>> +
>> +	call_srcu(&eh_frame_srcu, &sec->rcu, eh_frame_free_srcu);
> 
> [Severity: Critical]
> Can this cause a use-after-free if the maple tree erase operation fails?

Seems valid.  Fixed in next version.

> 
> If mas_erase fails due to memory exhaustion (for example, during tree
> rebalancing), it leaves the entry in the tree, sets mas_is_err(mas), and
> returns the pointer to the entry.
> 
> Because it returns the entry pointer, the condition mas_erase(mas) != sec
> will evaluate to false, skipping the error block.
> 
> The code would then proceed to call call_srcu and free the section while
> it remains linked in the maple tree, potentially causing a crash when the
> tree is traversed later. Should this check mas_is_err(mas) instead?
> 
>> +
>> +	return 0;
>> +}

>> diff --git a/mm/init-mm.c b/mm/init-mm.c

>> @@ -48,6 +49,7 @@ struct mm_struct init_mm = {
>>  #endif
>>  	.flexible_array	= MM_STRUCT_FLEXIBLE_ARRAY_INIT,
>>  	INIT_MM_CONTEXT(init_mm)
>> +	INIT_MM_EH_FRAME
>>  };
> 
> [Severity: Low]
> Does efi_mm in drivers/firmware/efi/efi.c also need this initializer?

Steven, Josh, I doubt that is required.  Do you agree?

Otherwise tboot_mm in arch/x86/kernel/tboot.c would be affected as well.

> 
> When a new initializer like INIT_MM_EH_FRAME is added to init_mm, it usually
> needs to be added to all static mm_struct definitions.
> 
> Leaving it out means the eh_frame_mt maple tree inside efi_mm remains
> zero-initialized rather than properly initialized with MTREE_INIT, which
> might lead to lock splats or crashes if accessed.

Thanks and regards,
Jens
-- 
Jens Remus
Linux on Z Development (D3303)
jremus@de.ibm.com / jremus@linux.ibm.com

IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: Ehningen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/