Re: [PATCH bpf-next 8/9] bpf: Remove trace_in argument from __bpf_get_stack

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_get_stack_pe permanently truncates the shared perf event callchain for user stacks.
--

--- Patch [8]: [PATCH bpf-next 8/9] bpf: Remove trace_in argument from __bpf_get_stack ---
commit 42ed70b803080e71468d115e2948bdba98a800f5
Author: Jiri Olsa <jolsa@kernel.org>

bpf: Remove trace_in argument from __bpf_get_stack

This commit removes the trace_in argument from __bpf_get_stack and
handles the trace_in case directly in a new __bpf_get_stack_pe function.
This simplifies __bpf_get_stack for upcoming preemption fixes.

> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
> index eea7b781300ca..57cd4c33403bd 100644
> --- a/kernel/bpf/stackmap.c
> +++ b/kernel/bpf/stackmap.c
[ ... ]
> @@ -978,14 +1001,13 @@ BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,
>  		skip += nr_kernel;
>  		if (skip > BPF_F_SKIP_FIELD_MASK)
>  			goto clear;
> -
>  		flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
> -		err = __bpf_get_stack(regs, NULL, trace, buf, size, flags, false /* !may_fault */);
> +		err = __bpf_get_stack_pe(trace, buf, size, flags);

[Severity: High]
This is a pre-existing issue, but does this permanently truncate the shared
perf event callchain for user stacks?

In bpf_get_stack_pe(), the kernel stack branch explicitly saves and restores
trace->nr around the call to __bpf_get_stack_pe().

However, the user stack branch directly calls __bpf_get_stack_pe() without
saving the original trace->nr value. Inside __bpf_get_stack_pe(), the trace
size is modified in place:

static int __bpf_get_stack_pe(...)
{
        ...
        max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
        trace->nr = min_t(u32, trace->nr, max_depth);
        ...
}

If a BPF program attached to a perf event requests a user stack trace and
provides a buffer smaller than the actual callchain length, trace->nr is
truncated.

When the perf subsystem later processes this event and outputs it to the
perf ring buffer, could this result in incomplete or corrupted profiling
data due to the truncated user space callchain length?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720085351.655075-1-jolsa@kernel.org?part=8