On 8/21/2026 10:09 PM, [email protected] wrote:

> When duplicating a process' virtual memory mappings also duplicate all
> of its registered .eh_frame_hdr sections stored in the per-mm maple tree
> to enable stacktracing using eh_frame of the child process.

>> diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c

>> @@ -1501,6 +1501,54 @@ int eh_frame_remove_section(unsigned long 
>> eh_frame_hdr_start)
>>      return 0;
>>  }
>>  
>> +static void __eh_frame_dup_section(struct eh_frame_section *sec,
>> +                               struct eh_frame_section *oldsec)
>> +{
> [ ... ]
>> +}
>> +
>> +int eh_frame_dup_mm(struct mm_struct *mm, struct mm_struct *oldmm)
>> +{
>> +    struct eh_frame_section *sec, *oldsec;
>> +    unsigned long index = 0;
>> +    int ret;
>> +
>> +    guard(srcu)(&eh_frame_srcu);
> 
> [Severity: Medium]
> Is it acceptable to mix goto-based error handling with guard() in the same
> function? The cleanup guidelines suggest converting all resources to
> scope-based cleanup or none to avoid confusing ownership semantics.

I think it is acceptable.

> 
>> +
>> +    mt_for_each(&oldmm->eh_frame_mt, oldsec, index, ULONG_MAX) {
> 
> [Severity: High]
> Does this unconditionally duplicate all eh_frame sections from the parent
> without checking if the underlying VMA was actually copied during the fork?
> 
> If a process sets a region to VM_DONTCOPY or VM_WIPEONFORK before forking,
> the child won't inherit the VMA, but it appears it will still inherit
> the eh_frame section here. If the child process later maps new executable
> code at the same address, could the unwinder use the parent's stale rules?

Steven, could you please advise?

> 
>> +            sec = kzalloc(sizeof(*sec), GFP_KERNEL_ACCOUNT);
>> +            if (!sec)
>> +                    return -ENOMEM;
>> +
>> +            __eh_frame_dup_section(sec, oldsec);
>> +
>> +            ret = mtree_insert_range(&mm->eh_frame_mt,
>> +                                     sec->text_start,
>> +                                     sec->text_end - 1,
>> +                                     sec, GFP_KERNEL_ACCOUNT);
>> +            if (ret)
>> +                    goto err_free;
>> +    }
>> +
>> +    return 0;
>> +
>> +err_free:
>> +    free_section(sec);
>> +    return ret;
>> +}
> 

Thanks and regards,
Jens
-- 
Jens Remus
Linux on Z Development (D3303)
[email protected] / [email protected]

IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: 
Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: 
Ehningen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/


Reply via email to