[PATCH bpf-next] bpf: Fix offset warn check for bpf_res_spin_lock

[PATCH bpf-next] bpf: Fix offset warn check for bpf_res_spin_lock

[Kumar Kartikeya Dwivedi]

Sashiko pointed out correctly that the case statement for
BPF_RES_SPIN_LOCK incorrectly checks offset for BPF_SPIN_LOCK.
Fix it by checking res_spin_lock_off instead.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/btf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index cbb1e49b9bcb..e7d4e9ba24e2 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4168,7 +4168,7 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type
 			rec->spin_lock_off = rec->fields[i].offset;
 			break;
 		case BPF_RES_SPIN_LOCK:
-			WARN_ON_ONCE(rec->spin_lock_off >= 0);
+			WARN_ON_ONCE(rec->res_spin_lock_off >= 0);
 			/* Cache offset for faster lookup at runtime */
 			rec->res_spin_lock_off = rec->fields[i].offset;
 			break;
--
2.53.0

Re: [PATCH bpf-next] bpf: Fix offset warn check for bpf_res_spin_lock

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unprivileged users can trigger a `WARN_ON_ONCE` in the kernel (causing a panic on systems with `panic_on_warn` enabled) by supplying a crafted BTF with duplicate unique fields hidden inside nested structs.
--

--- Patch [1]: [PATCH bpf-next] bpf: Fix offset warn check for bpf_res_spin_lock ---
commit 5f18853b127e7eb3f89c39c50e8644777d002289
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Fix offset warn check for bpf_res_spin_lock

Sashiko pointed out correctly that the case statement for
BPF_RES_SPIN_LOCK incorrectly checks offset for BPF_SPIN_LOCK.
Fix it by checking res_spin_lock_off instead.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index cbb1e49b9bcbf..e7d4e9ba24e26 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4168,7 +4168,7 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type
>  			rec->spin_lock_off = rec->fields[i].offset;
>  			break;
>  		case BPF_RES_SPIN_LOCK:
> -			WARN_ON_ONCE(rec->spin_lock_off >= 0);
> +			WARN_ON_ONCE(rec->res_spin_lock_off >= 0);

[Severity: High]
This is a pre-existing issue, but can unprivileged users trigger this
WARN_ON_ONCE() by supplying a crafted BTF with duplicate unique fields
hidden inside nested structs?

Looking at btf_find_struct_field(), it enforces the uniqueness of special
BTF fields using a local seen_mask variable:

kernel/bpf/btf.c:btf_find_struct_field() {
    ...
    u32 i, off, seen_mask = 0;
    ...
    ret = btf_find_field_one(..., &seen_mask, ...);
    ...
}

However, when it encounters a nested struct, it recursively calls itself
via btf_find_nested_struct(). This nested call initializes a fresh
seen_mask = 0, ignoring the parent's state.

If a user crafts a BTF with multiple nested structs containing duplicate
unique fields (like BPF_SPIN_LOCK or BPF_RES_SPIN_LOCK), wouldn't these
duplicates bypass the seen_mask checks and be returned to
btf_parse_fields()?

Since btf_parse_fields() processes these duplicates and hits this
WARN_ON_ONCE() macro, could this act as a local Denial of Service (DoS)
vector on systems configured with panic_on_warn=1?

>  			/* Cache offset for faster lookup at runtime */
>  			rec->res_spin_lock_off = rec->fields[i].offset;
>  			break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260719121740.1547434-1-memxor@gmail.com?part=1

Re: [PATCH bpf-next] bpf: Fix offset warn check for bpf_res_spin_lock

[Emil Tsalapatis]

On Sun Jul 19, 2026 at 8:17 AM EDT, Kumar Kartikeya Dwivedi wrote:
> Sashiko pointed out correctly that the case statement for
> BPF_RES_SPIN_LOCK incorrectly checks offset for BPF_SPIN_LOCK.
> Fix it by checking res_spin_lock_off instead.
>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  kernel/bpf/btf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index cbb1e49b9bcb..e7d4e9ba24e2 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4168,7 +4168,7 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type
>  			rec->spin_lock_off = rec->fields[i].offset;
>  			break;
>  		case BPF_RES_SPIN_LOCK:
> -			WARN_ON_ONCE(rec->spin_lock_off >= 0);
> +			WARN_ON_ONCE(rec->res_spin_lock_off >= 0);
>  			/* Cache offset for faster lookup at runtime */
>  			rec->res_spin_lock_off = rec->fields[i].offset;
>  			break;
> --
> 2.53.0