Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] sframe: UAF and lockdep warning due to missing RCU lock around module lookup - [Medium] sframe: architecture abstraction violation in generic module code --
commit d8442279cd580755fb98f0f72b910fcd83585a23 Author: Dylan Hatch <[email protected]> arm64/module, sframe: Add sframe support for modules This commit adds SFrame support for kernel modules on ARM64 by extending the architecture-specific module structure. It parses the .sframe section from incoming modules during load time and registers it for stack unwinding. > diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h > index fb9b88eebeb15..07f309c51eee6 100644 > --- a/arch/arm64/include/asm/module.h > +++ b/arch/arm64/include/asm/module.h [ ... ] > @@ -17,6 +18,11 @@ struct mod_arch_specific { > struct mod_plt_sec core; > struct mod_plt_sec init; > > +#ifdef CONFIG_HAVE_UNWIND_KERNEL_SFRAME > + struct sframe_section sframe_sec; > + bool sframe_init; > +#endif > + [Severity: Medium] Will this break cross-architecture builds if other architectures attempt to adopt SFrame? By placing these generically named fields into the ARM64-specific mod_arch_specific struct, generic unwinder code in kernel/unwind/sframe.c is now tightly coupled to an architecture-private layout. Should these generic module extensions reside directly in struct module (in include/linux/module.h) under the appropriate config guards instead? [ ... ] > diff --git a/kernel/unwind/sframe.c b/kernel/unwind/sframe.c > index 9aac703f7ce6e..503d4a2beb50e 100644 > --- a/kernel/unwind/sframe.c > +++ b/kernel/unwind/sframe.c [ ... ] > @@ -405,12 +409,43 @@ static __always_inline int __sframe_find(struct > sframe_section *sec, > return __find_fre(sec, &fde, ip, frame); > } > > +#ifdef CONFIG_MODULES > + > +static __always_inline int __sframe_find_module(unsigned long ip, > + struct unwind_frame *frame) > +{ > + struct module *mod; > + > + mod = __module_text_address(ip); [Severity: High] Does this code introduce a use-after-free and a lockdep warning? Stack unwinding can be initiated from preemptible contexts, but __module_text_address() requires preemption to be disabled or the RCU read lock to be held. If a module is concurrently unloaded via sys_delete_module() immediately after __module_text_address() returns, the returned pointer becomes dangling. The subsequent call to __sframe_find() would then dereference pointers within the freed memory. Should this lookup and data access be wrapped in guard(rcu)(); or an rcu_read_lock() / rcu_read_unlock() block? > + if (!mod || !READ_ONCE(mod->arch.sframe_init)) > + return -EINVAL; > + > + return __sframe_find(&mod->arch.sframe_sec, ip, frame); [Severity: Medium] Does this generic lookup code directly reach into the arch-specific abstraction? This creates a tight coupling between the generic module unwinder and the ARM64-specific layout. [ ... ] > +void sframe_module_init(struct module *mod, void *sframe, size_t sframe_size) > +{ > + struct sframe_section *sec = &mod->arch.sframe_sec; [Severity: Medium] Is it safe for this generic initialization code to assume the presence of the sframe_sec field in the architecture-private mod_arch_specific structure? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
