# Re: \[RFC PATCH v2 17/24\] unwind\_user/eh\_frame: Add support for DWARF expressions

- From: Jens Remus \<hidden\>
- Date: 2026-09-14 14:50:43 
- List: linux-trace-kernel
- Page: https://ratatoskr.run/linux-trace-kernel/2026/09/17574122
- Thread: https://ratatoskr.run/sashiko-reviews/2026/09/17574122/t.md

```text
On 8/21/2026 10:18 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

>     Enable architectures to handle DWARF expressions in DWARF CFI
>     instructions DW_CFA_def_cfa_expression, DW_CFA_expression, and
>     DW_CFA_val_expression. Limit the maximum expression length to a
>     reasonable size, while enabling architectures to override the
>     limit.

>> diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c

>> @@ -803,6 +772,27 @@ static __always_inline int __do_cfi_insn(struct eh_frame_section *sec,
>>  			break;
>>  		}
>>  
>> +		case DW_CFA_def_cfa_expression: {
>> +			unsigned long expr_len;
>> +			char expr[EH_FRAME_MAX_EXPRESSION_LENGTH];
>> +
>> +			ret = read_uleb128(&cur, end, &expr_len);
>> +			if (ret)
>> +				return ret;
>> +
>> +			if (cur + expr_len < cur || cur + expr_len > end)
>> +				return -EINVAL;
>> +
>> +			if (expr_len > sizeof(expr))
>> +				return -EOPNOTSUPP;
>> +			unsafe_copy_from_user(&expr, (void __user *)cur, expr_len, Efault);
> 
> [Severity: Low]
> Does this unaligned stack buffer passed to unsafe_copy_from_user() cause
> undefined behavior?
> 
> Passing a 1-byte aligned char array to unsafe_copy_from_user() violates C
> alignment rules. In architecture-specific implementations, the macro
> explicitly casts the destination pointer to larger integer types (e.g.,
> u64 *) to perform optimized word-sized memory assignments. Dereferencing
> an unaligned pointer is Undefined Behavior in C.

AFAIK [unsafe_]copy_from_user() has no source or destination alignment
requirements.

The reported concern appears to be specific to the proposed x86
implementation (see next patch "[RFC PATCH v2 18/24] x86/uaccess: Add
unsafe_copy_from_user() implementation"), which casts the pointers
to u64 *, u32 *, and so on.

> 
> While x86 hardware gracefully handles unaligned memory accesses, the
> compiler's optimizer is legally allowed to assume u64 * is 8-byte aligned
> and could emit trapping instructions. Furthermore, if this generic .eh_frame
> code is later enabled on architectures with strict hardware alignment
> enforcement, it will immediately trigger alignment exceptions.

This is currently enforced very early by "[RFC PATCH v2 07/24]
unwind_user/eh_frame: Add support for reading .eh_frame_hdr section":

	/*
	 * Unaligned access to .eh_frame[_hdr] fields using
	 * unsafe_get_user() via UNSAFE_GET_USER_INC()
	 */
	BUILD_BUG_ON(!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS));

> 
> Could this buffer be declared with __aligned(8) or as an array of u64?

I don't think this makes sense.

> 
>> +			ret = eh_frame_do_def_cfa_expression(expr, expr_len, target_ip, &ctx->state);
>> +			if (ret)
>> +				return ret;
>> +			cur += expr_len;
>> +			break;
>> +		}
>> +
Regards,
Jens
-- 
Jens Remus
Linux on Z Development (D3303)
jremus@de.ibm.com / jremus@linux.ibm.com

IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: Ehningen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/

```