Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] Unnamed bitfields break nested anonymous struct resolution in 
btf_find_struct_member().
--

commit 20a606aa6d4e155be5a531c5d52d78c34205c0b4
Author: Masami Hiramatsu (Google) <[email protected]>

tracing/probes: Fix BTF kflag check for anonymous struct member access

This commit fixes how BTF kflags are checked when traversing nested
anonymous structures and unions in btf_find_struct_member() by using
the actual containing type.

> diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c
> --- a/kernel/trace/trace_btf.c
> +++ b/kernel/trace/trace_btf.c

[ ... ]

> @@ -91,17 +92,23 @@ const struct btf_member *btf_find_struct_member(struct 
> btf *btf,
>       for_each_member(i, type, member) {
>               if (!member->name_off) {
>                       /* Anonymous union/struct: push it for later use */
> +                     u32 m_off = btf_type_kflag(type) ?
> +                             BTF_MEMBER_BIT_OFFSET(member->offset) :
> +                             member->offset;
> +
>                       if (btf_type_skip_modifiers(btf, member->type, &tid) &&
>                           top < BTF_ANON_STACK_MAX) {
>                               anon_stack[top].tid = tid;
>                               anon_stack[top++].offset =
> -                                     cur_offset + member->offset;
> +                                     cur_offset + m_off;
>                       }
>               } else {

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for unnamed
bitfields to break nested anonymous struct resolution here?

Since unnamed bitfields (like int : 5) also have name_off == 0, they get
pushed onto anon_stack alongside actual anonymous structs.

Because anon_stack is processed in LIFO order, an unnamed bitfield defined
after an anonymous struct will be popped first. When it is popped at the top
of btf_find_struct_member():

retry:
        if (!btf_type_is_struct(type)) {
                member = ERR_PTR(-EINVAL);
                goto out;
        }

Does this cause the scalar type check to fail and abort the entire search,
preventing the earlier anonymous struct from ever being searched?

>                       name = btf_name_by_offset(btf, member->name_off);
>                       if (name && !strcmp(member_name, name)) {
>                               if (anon_offset)
>                                       *anon_offset = cur_offset;

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/178810001186.64882.2161016469449127450.stgit@devnote2?part=2

Reply via email to