Re: [PATCH bpf-next 3/3] bpftool: Add tracing_multi link info output

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Repeated parsing of `/proc/kallsyms` in an O(N) loop when symbol loading fails.
--

commit 0f11f8e705a95b6aa483a05374ffb9b22bcb78c0
Author: Jiri Olsa <jolsa@kernel.org>

bpftool: Add tracing_multi link info output

This commit adds bpftool support to show tracing_multi link details for both
plain and JSON outputs.

> diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
> index bdcd717b0348f..58dadee984a07 100644
> --- a/tools/bpf/bpftool/link.c
> +++ b/tools/bpf/bpftool/link.c
> @@ -377,6 +377,31 @@ static __u64 *u64_to_arr(__u64 val)
>  	return (__u64 *) u64_to_ptr(val);
>  }
>  
> +static __u32 *u64_to_u32_arr(__u64 val)
> +{
> +	return (__u32 *)u64_to_ptr(val);
> +}
> +
> +static struct kernel_sym *find_kernel_sym_by_addr(__u64 addr, bool is_ibt_enabled)
> +{
> +	struct kernel_sym *sym;
> +
> +	if (!addr)
> +		return NULL;
> +
> +	/* Load it once for all. */
> +	if (!dd.sym_count)
> +		kernel_syms_load(&dd);
> +	if (!dd.sym_count)
> +		return NULL;
> +
> +	sym = kernel_syms_search(&dd, addr);
> +	if (!sym && is_ibt_enabled && addr >= 4)
> +		sym = kernel_syms_search(&dd, addr - 4);
> +
> +	return sym;
> +}

[ ... ]

> @@ -403,6 +428,43 @@ show_uprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
>  	jsonw_end_array(json_wtr);
>  }
>  
> +static void
> +show_tracing_multi_json(struct bpf_link_info *info, json_writer_t *wtr)
> +{
> +	bool is_ibt_enabled = is_x86_ibt_enabled();
> +	__u32 i;
> +
> +	show_link_attach_type_json(info->tracing_multi.attach_type, wtr);
> +	jsonw_uint_field(wtr, "func_cnt", info->tracing_multi.count);
> +	jsonw_uint_field(wtr, "obj_id", info->tracing_multi.obj_id);
> +	jsonw_name(wtr, "funcs");
> +
> +	jsonw_start_array(wtr);
> +
> +	for (i = 0; i < info->tracing_multi.count; i++) {
> +		__u64 addr = u64_to_arr(info->tracing_multi.addrs)[i];
> +		struct kernel_sym *sym;
> +
> +		sym = find_kernel_sym_by_addr(addr, is_ibt_enabled);

[Severity: Medium]
If kernel_syms_load() fails (for example, due to kernel.kptr_restrict or
a lack of read permissions for /proc/kallsyms), dd.sym_count remains 0.

Since find_kernel_sym_by_addr() checks !dd.sym_count to decide whether to load
symbols, won't this cause /proc/kallsyms to be repeatedly opened and parsed on
every iteration of this loop if the initial load fails?

This loop occurs here in show_tracing_multi_json() as well as in
show_tracing_multi_plain(). For tracing_multi links with potentially thousands
of targets, could this result in a significant performance hang for bpftool?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260621204524.61067-1-jolsa@kernel.org?part=3