On Sun, 30 Aug 2026 14:38:59 +0000
[email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
> to consider:
>
> Pre-existing issues:
> - [High] Unnamed bitfields break nested anonymous struct resolution in
> btf_find_struct_member().
> --
>
> commit 20a606aa6d4e155be5a531c5d52d78c34205c0b4
> Author: Masami Hiramatsu (Google) <[email protected]>
>
> tracing/probes: Fix BTF kflag check for anonymous struct member access
>
> This commit fixes how BTF kflags are checked when traversing nested
> anonymous structures and unions in btf_find_struct_member() by using
> the actual containing type.
>
> > diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c
> > --- a/kernel/trace/trace_btf.c
> > +++ b/kernel/trace/trace_btf.c
>
> [ ... ]
>
> > @@ -91,17 +92,23 @@ const struct btf_member *btf_find_struct_member(struct
> > btf *btf,
> > for_each_member(i, type, member) {
> > if (!member->name_off) {
> > /* Anonymous union/struct: push it for later use */
> > + u32 m_off = btf_type_kflag(type) ?
> > + BTF_MEMBER_BIT_OFFSET(member->offset) :
> > + member->offset;
> > +
> > if (btf_type_skip_modifiers(btf, member->type, &tid) &&
> > top < BTF_ANON_STACK_MAX) {
> > anon_stack[top].tid = tid;
> > anon_stack[top++].offset =
> > - cur_offset + member->offset;
> > + cur_offset + m_off;
> > }
> > } else {
>
> [Severity: High]
> This isn't a bug introduced by this patch, but is it possible for unnamed
> bitfields to break nested anonymous struct resolution here?
>
Oops, unnamed bitfield.... I didn't expected that.
> Since unnamed bitfields (like int : 5) also have name_off == 0, they get
> pushed onto anon_stack alongside actual anonymous structs.
OK, I got it. This function only expects anonymous struct/union, not
anonymous bitfield.
>
> Because anon_stack is processed in LIFO order, an unnamed bitfield defined
> after an anonymous struct will be popped first. When it is popped at the top
> of btf_find_struct_member():
>
> retry:
> if (!btf_type_is_struct(type)) {
> member = ERR_PTR(-EINVAL);
> goto out;
> }
>
> Does this cause the scalar type check to fail and abort the entire search,
> preventing the earlier anonymous struct from ever being searched?
Yeah, this is wrong. it should check this is the last anon_stack entry
and retry. Maybe we should make it a loop.
Thanks!
>
> > name = btf_name_by_offset(btf, member->name_off);
> > if (name && !strcmp(member_name, name)) {
> > if (anon_offset)
> > *anon_offset = cur_offset;
>
> --
> Sashiko AI review ยท
> https://sashiko.dev/#/patchset/178810001186.64882.2161016469449127450.stgit@devnote2?part=2
--
Masami Hiramatsu (Google) <[email protected]>
