Re: [PATCH v14 02/14] tracing/probes: Fix BTF kflag check for anonymous struct member access

On Sun, 30 Aug 2026 14:38:59 +0000
sashiko-bot@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unnamed bitfields break nested anonymous struct resolution in btf_find_struct_member().
--

commit 20a606aa6d4e155be5a531c5d52d78c34205c0b4
Author: Masami Hiramatsu (Google) [off-list ref]

tracing/probes: Fix BTF kflag check for anonymous struct member access

This commit fixes how BTF kflags are checked when traversing nested
anonymous structures and unions in btf_find_struct_member() by using
the actual containing type.

quoted

diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c
--- a/kernel/trace/trace_btf.c
+++ b/kernel/trace/trace_btf.c

[ ... ]

quoted

@@ -91,17 +92,23 @@ const struct btf_member *btf_find_struct_member(struct btf *btf,
 	for_each_member(i, type, member) {
 		if (!member->name_off) {
 			/* Anonymous union/struct: push it for later use */
+			u32 m_off = btf_type_kflag(type) ?
+				BTF_MEMBER_BIT_OFFSET(member->offset) :
+				member->offset;
+
 			if (btf_type_skip_modifiers(btf, member->type, &tid) &&
 			    top < BTF_ANON_STACK_MAX) {
 				anon_stack[top].tid = tid;
 				anon_stack[top++].offset =
-					cur_offset + member->offset;
+					cur_offset + m_off;
 			}
 		} else {

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for unnamed
bitfields to break nested anonymous struct resolution here?

Oops, unnamed bitfield.... I didn't expected that.

Since unnamed bitfields (like int : 5) also have name_off == 0, they get
pushed onto anon_stack alongside actual anonymous structs.

OK, I got it. This function only expects anonymous struct/union, not
anonymous bitfield.

Because anon_stack is processed in LIFO order, an unnamed bitfield defined
after an anonymous struct will be popped first. When it is popped at the top
of btf_find_struct_member():

retry:
	if (!btf_type_is_struct(type)) {
		member = ERR_PTR(-EINVAL);
		goto out;
	}

Does this cause the scalar type check to fail and abort the entire search,
preventing the earlier anonymous struct from ever being searched?

Yeah, this is wrong. it should check this is the last anon_stack entry
and retry. Maybe we should make it a loop.

Thanks!

quoted

 			name = btf_name_by_offset(btf, member->name_off);
 			if (name && !strcmp(member_name, name)) {
 				if (anon_offset)
 					*anon_offset = cur_offset;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/178810001186.64882.2161016469449127450.stgit@devnote2?part=2

-- 
Masami Hiramatsu (Google) [off-list ref]