Re: [PATCH v10 11/11] tracing/wprobe: Support BTF typecast in wprobe trigger command

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect BTF kflag check in get_offset_of_field() falsely rejects nested structs and computes massive out-of-bounds offsets for bitfield members.
--

--- Patch [11]: [PATCH v10 11/11] tracing/wprobe: Support BTF typecast in wprobe trigger command ---
commit 61f26bb67fea52d49bbb314e0a53092298348830
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>

tracing/wprobe: Support BTF typecast in wprobe trigger command

This commit extends the set_wprobe trigger syntax to support automatic 
BTF-based offset calculation. It allows symbolic watchpoint placement at 
specific struct fields by resolving the offset of a member within a struct 
type using BTF, avoiding the need for manual numeric offsets.

> diff --git a/kernel/trace/trace_wprobe.c b/kernel/trace/trace_wprobe.c
> index 1edfdddf241de..2926eabfe3c1d 100644
> --- a/kernel/trace/trace_wprobe.c
> +++ b/kernel/trace/trace_wprobe.c

[ ... ]

> @@ -925,6 +926,143 @@ static void wprobe_trigger_free(struct event_trigger_data *data)
>  	}
>  }
>  
> +#ifdef CONFIG_PROBE_EVENTS_BTF_ARGS
> +
> +static int get_offset_of_field(struct btf *btf, const struct btf_type *type, char *field_name)
> +{
> +	const struct btf_member *field;
> +	int bitoffs = 0;
> +	u32 anon_offs;
> +	char *next;
> +
> +	do {
> +		next = strchr(field_name, '.');
> +		if (next)
> +			*next++ = '\0';
> +
> +		field = btf_find_struct_member(btf, type, field_name, &anon_offs);
> +		if (IS_ERR_OR_NULL(field))
> +			return -ENOENT;
> +		type = btf_type_by_id(btf, field->type);
> +
> +		/* Reject bitfield member access */
> +		if (btf_type_kflag(type))
> +			return -EINVAL;
> +
> +		/* add offset for anonymous struct type */
> +		bitoffs += anon_offs + field->offset;

[Severity: High]
Does this code in get_offset_of_field() incorrectly check the child member's
type instead of the parent struct?

Because the type variable is updated to the child member's type before
evaluating btf_type_kflag(type), it seems this check will fail to reject
bitfields (since a child type like BTF_KIND_INT doesn't have a kflag).

When a bitfield is not rejected, field->offset (which contains the bitfield
size shifted by 24 bits for structs with kflag=1) is directly added to
bitoffs, producing an out-of-bounds byte offset for the watchpoint.

Additionally, could this falsely reject valid accesses if the target member
is a nested struct that does have its kflag set?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/178476134787.26117.10094977293012760490.stgit@devnote2?part=11