On 8/21/2026 10:13 PM, [email protected] wrote:
> This commit associates .eh_frame_hdr sections with their mm_struct by
> adding them to a per-mm maple tree. The tree is indexed by the
> corresponding text address ranges.
>> diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c
>> +static int __eh_frame_remove_section(struct ma_state *mas,
>> + struct eh_frame_section *sec)
>> +{
struct eh_frame_section *erased;
erased = mas_erase(mas);
>> + if (mas_erase(mas) != sec) {
if (mas_is_err(mas) || erased != sec) {
>> + dbg("mas_erase failed: text=%lx\n", sec->text_start);
>> + return -EINVAL;
>> + }
>> +
>> + call_srcu(&eh_frame_srcu, &sec->rcu, eh_frame_free_srcu);
>
> [Severity: Critical]
> Can this cause a use-after-free if the maple tree erase operation fails?
Seems valid. Fixed in next version.
>
> If mas_erase fails due to memory exhaustion (for example, during tree
> rebalancing), it leaves the entry in the tree, sets mas_is_err(mas), and
> returns the pointer to the entry.
>
> Because it returns the entry pointer, the condition mas_erase(mas) != sec
> will evaluate to false, skipping the error block.
>
> The code would then proceed to call call_srcu and free the section while
> it remains linked in the maple tree, potentially causing a crash when the
> tree is traversed later. Should this check mas_is_err(mas) instead?
>
>> +
>> + return 0;
>> +}
>> diff --git a/mm/init-mm.c b/mm/init-mm.c
>> @@ -48,6 +49,7 @@ struct mm_struct init_mm = {
>> #endif
>> .flexible_array = MM_STRUCT_FLEXIBLE_ARRAY_INIT,
>> INIT_MM_CONTEXT(init_mm)
>> + INIT_MM_EH_FRAME
>> };
>
> [Severity: Low]
> Does efi_mm in drivers/firmware/efi/efi.c also need this initializer?
Steven, Josh, I doubt that is required. Do you agree?
Otherwise tboot_mm in arch/x86/kernel/tboot.c would be affected as well.
>
> When a new initializer like INIT_MM_EH_FRAME is added to init_mm, it usually
> needs to be added to all static mm_struct definitions.
>
> Leaving it out means the eh_frame_mt maple tree inside efi_mm remains
> zero-initialized rather than properly initialized with MTREE_INIT, which
> might lead to lock splats or crashes if accessed.
Thanks and regards,
Jens
--
Jens Remus
Linux on Z Development (D3303)
[email protected] / [email protected]
IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats:
Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft:
Ehningen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/
