Re: [PATCH v14 02/14] tracing/probes: Fix BTF kflag check for anonymous struct member access
From: sashiko-bot@kernel.org
Date: 2026-08-30 14:39:00
Also in:
linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Unnamed bitfields break nested anonymous struct resolution in btf_find_struct_member(). -- commit 20a606aa6d4e155be5a531c5d52d78c34205c0b4 Author: Masami Hiramatsu (Google) [off-list ref] tracing/probes: Fix BTF kflag check for anonymous struct member access This commit fixes how BTF kflags are checked when traversing nested anonymous structures and unions in btf_find_struct_member() by using the actual containing type.
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c --- a/kernel/trace/trace_btf.c +++ b/kernel/trace/trace_btf.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -91,17 +92,23 @@ const struct btf_member *btf_find_struct_member(struct btf *btf, for_each_member(i, type, member) { if (!member->name_off) { /* Anonymous union/struct: push it for later use */ + u32 m_off = btf_type_kflag(type) ? + BTF_MEMBER_BIT_OFFSET(member->offset) : + member->offset; + if (btf_type_skip_modifiers(btf, member->type, &tid) && top < BTF_ANON_STACK_MAX) { anon_stack[top].tid = tid; anon_stack[top++].offset = - cur_offset + member->offset; + cur_offset + m_off; } } else {
[Severity: High]
This isn't a bug introduced by this patch, but is it possible for unnamed
bitfields to break nested anonymous struct resolution here?
Since unnamed bitfields (like int : 5) also have name_off == 0, they get
pushed onto anon_stack alongside actual anonymous structs.
Because anon_stack is processed in LIFO order, an unnamed bitfield defined
after an anonymous struct will be popped first. When it is popped at the top
of btf_find_struct_member():
retry:
if (!btf_type_is_struct(type)) {
member = ERR_PTR(-EINVAL);
goto out;
}
Does this cause the scalar type check to fail and abort the entire search,
preventing the earlier anonymous struct from ever being searched?
name = btf_name_by_offset(btf, member->name_off);
if (name && !strcmp(member_name, name)) {
if (anon_offset)
*anon_offset = cur_offset;-- Sashiko AI review · https://sashiko.dev/#/patchset/178810001186.64882.2161016469449127450.stgit@devnote2?part=2