On 8/21/2026 10:18 PM, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
> to consider:
> Enable architectures to handle DWARF expressions in DWARF CFI
> instructions DW_CFA_def_cfa_expression, DW_CFA_expression, and
> DW_CFA_val_expression. Limit the maximum expression length to a
> reasonable size, while enabling architectures to override the
> limit.
>> diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c
>> @@ -803,6 +772,27 @@ static __always_inline int __do_cfi_insn(struct
>> eh_frame_section *sec,
>> break;
>> }
>>
>> + case DW_CFA_def_cfa_expression: {
>> + unsigned long expr_len;
>> + char expr[EH_FRAME_MAX_EXPRESSION_LENGTH];
>> +
>> + ret = read_uleb128(&cur, end, &expr_len);
>> + if (ret)
>> + return ret;
>> +
>> + if (cur + expr_len < cur || cur + expr_len > end)
>> + return -EINVAL;
>> +
>> + if (expr_len > sizeof(expr))
>> + return -EOPNOTSUPP;
>> + unsafe_copy_from_user(&expr, (void __user *)cur,
>> expr_len, Efault);
>
> [Severity: Low]
> Does this unaligned stack buffer passed to unsafe_copy_from_user() cause
> undefined behavior?
>
> Passing a 1-byte aligned char array to unsafe_copy_from_user() violates C
> alignment rules. In architecture-specific implementations, the macro
> explicitly casts the destination pointer to larger integer types (e.g.,
> u64 *) to perform optimized word-sized memory assignments. Dereferencing
> an unaligned pointer is Undefined Behavior in C.
AFAIK [unsafe_]copy_from_user() has no source or destination alignment
requirements.
The reported concern appears to be specific to the proposed x86
implementation (see next patch "[RFC PATCH v2 18/24] x86/uaccess: Add
unsafe_copy_from_user() implementation"), which casts the pointers
to u64 *, u32 *, and so on.
>
> While x86 hardware gracefully handles unaligned memory accesses, the
> compiler's optimizer is legally allowed to assume u64 * is 8-byte aligned
> and could emit trapping instructions. Furthermore, if this generic .eh_frame
> code is later enabled on architectures with strict hardware alignment
> enforcement, it will immediately trigger alignment exceptions.
This is currently enforced very early by "[RFC PATCH v2 07/24]
unwind_user/eh_frame: Add support for reading .eh_frame_hdr section":
/*
* Unaligned access to .eh_frame[_hdr] fields using
* unsafe_get_user() via UNSAFE_GET_USER_INC()
*/
BUILD_BUG_ON(!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS));
>
> Could this buffer be declared with __aligned(8) or as an array of u64?
I don't think this makes sense.
>
>> + ret = eh_frame_do_def_cfa_expression(expr, expr_len,
>> target_ip, &ctx->state);
>> + if (ret)
>> + return ret;
>> + cur += expr_len;
>> + break;
>> + }
>> +
Regards,
Jens
--
Jens Remus
Linux on Z Development (D3303)
[email protected] / [email protected]
IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats:
Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft:
Ehningen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/
