Re: [PATCH v7 05/11] arm64/module, sframe: Add sframe support for modules

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] sframe: UAF and lockdep warning due to missing RCU lock around module lookup
- [Medium] sframe: architecture abstraction violation in generic module code
--

commit d8442279cd580755fb98f0f72b910fcd83585a23
Author: Dylan Hatch <dylanbhatch@google.com>

arm64/module, sframe: Add sframe support for modules

This commit adds SFrame support for kernel modules on ARM64 by extending
the architecture-specific module structure. It parses the .sframe section
from incoming modules during load time and registers it for stack unwinding.

> diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
> index fb9b88eebeb15..07f309c51eee6 100644
> --- a/arch/arm64/include/asm/module.h
> +++ b/arch/arm64/include/asm/module.h
[ ... ]
> @@ -17,6 +18,11 @@ struct mod_arch_specific {
>  	struct mod_plt_sec	core;
>  	struct mod_plt_sec	init;
>  
> +#ifdef CONFIG_HAVE_UNWIND_KERNEL_SFRAME
> +	struct sframe_section sframe_sec;
> +	bool sframe_init;
> +#endif
> +

[Severity: Medium]
Will this break cross-architecture builds if other architectures attempt to
adopt SFrame?

By placing these generically named fields into the ARM64-specific
mod_arch_specific struct, generic unwinder code in kernel/unwind/sframe.c
is now tightly coupled to an architecture-private layout.

Should these generic module extensions reside directly in struct module
(in include/linux/module.h) under the appropriate config guards instead?

[ ... ]
> diff --git a/kernel/unwind/sframe.c b/kernel/unwind/sframe.c
> index 9aac703f7ce6e..503d4a2beb50e 100644
> --- a/kernel/unwind/sframe.c
> +++ b/kernel/unwind/sframe.c
[ ... ]
> @@ -405,12 +409,43 @@ static __always_inline int __sframe_find(struct sframe_section *sec,
>  	return __find_fre(sec, &fde, ip, frame);
>  }
>  
> +#ifdef CONFIG_MODULES
> +
> +static __always_inline int __sframe_find_module(unsigned long ip,
> +						struct unwind_frame *frame)
> +{
> +	struct module *mod;
> +
> +	mod = __module_text_address(ip);

[Severity: High]
Does this code introduce a use-after-free and a lockdep warning?

Stack unwinding can be initiated from preemptible contexts, but
__module_text_address() requires preemption to be disabled or the RCU read
lock to be held. If a module is concurrently unloaded via sys_delete_module()
immediately after __module_text_address() returns, the returned pointer
becomes dangling.

The subsequent call to __sframe_find() would then dereference pointers within
the freed memory. Should this lookup and data access be wrapped in
guard(rcu)(); or an rcu_read_lock() / rcu_read_unlock() block?

> +	if (!mod || !READ_ONCE(mod->arch.sframe_init))
> +		return -EINVAL;
> +
> +	return  __sframe_find(&mod->arch.sframe_sec, ip, frame);

[Severity: Medium]
Does this generic lookup code directly reach into the arch-specific
abstraction? This creates a tight coupling between the generic module unwinder
and the ARM64-specific layout.

[ ... ]
> +void sframe_module_init(struct module *mod, void *sframe, size_t sframe_size)
> +{
> +	struct sframe_section *sec = &mod->arch.sframe_sec;

[Severity: Medium]
Is it safe for this generic initialization code to assume the presence of
the sframe_sec field in the architecture-private mod_arch_specific structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918224157.1471085-1-dylanbhatch@google.com?part=5