All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Gabriele Monaco" <gmonaco@redhat.com>
Cc: linux-trace-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name()
Date: Mon, 31 Aug 2026 09:24:05 +0000	[thread overview]
Message-ID: <20260831092405.931CF1F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260831090524.106845-7-gmonaco@redhat.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] rv_is_container_monitor() fails to identify an empty container if it is the last element in the list, leading to a NULL pointer dereference when enabled.
--

commit a8e1e1f414fc69c200ed8ba3fee4d10346fe86df
Author: Gabriele Monaco <gmonaco@redhat.com>

rv: Add rv_get_monitor_by_name()
    
Add a helper function to get the rv_monitor pointer for a registered
monitor given its name and add its first user in rv_register_monitor().

> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> index f77c5865f41ab..33919c5fbd6ad 100644
> --- a/kernel/trace/rv/rv.c
> +++ b/kernel/trace/rv/rv.c
[ ... ]
> @@ -229,6 +230,18 @@ bool rv_is_container_monitor(struct rv_monitor *mon)
>  	return next->parent == mon || !mon->enable;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing
issue in rv_is_container_monitor(). Does this function incorrectly classify
an empty container monitor if it happens to be the last element in
rv_monitors_list?

Looking at the rest of rv_is_container_monitor():

bool rv_is_container_monitor(struct rv_monitor *mon)
{
	...
	if (list_is_last(&mon->list, &rv_monitors_list))
		return false;

	next = list_next_entry(mon, list);
	return next->parent == mon || !mon->enable;
}

If an empty container monitor (which has a NULL enable function) is the last
element, it returns false early. This bypasses the !mon->enable check,
treating the empty container as a regular monitor.

If a user then writes to its tracefs enable file, rv_enable_single() appears
to unconditionally call the enable function:

	retval = mon->enable();

Since the empty container monitor has a NULL enable pointer, will this lead
to a kernel panic via a NULL pointer dereference when enabled?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831090524.106845-1-gmonaco@redhat.com?part=6

  reply	other threads:[~2026-08-31  9:24 UTC|newest]

Thread overview: 49+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-31  9:05 [RFC PATCH 00/20] rv: Add support for BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 01/20] sched: Add task enqueue/dequeue trace points Gabriele Monaco
2026-08-31  9:32   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 02/20] tools/rv: Skip empty pid error in selftest if command failed Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 03/20] rv: Refactor da_trace() functions to get strings internally Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 04/20] rv: Use static arrays for rv_monitor name and description Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 05/20] rv: Add in-kernel support for BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name() Gabriele Monaco
2026-08-31  9:24   ` sashiko-bot [this message]
2026-08-31  9:05 ` [RFC PATCH 07/20] rv: Add reactors support to BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 08/20] rv: Cast result of model_get_*_name() Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 09/20] rv: Handle unregistered monitors safely in tracefs Gabriele Monaco
2026-08-31  9:24   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 10/20] tools/build: Add a feature test for bpftool-btf Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 11/20] tools/rv: Move argument parsing from in_kernel to utils Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 12/20] tools/rv: Export functionality for in_kernel monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 13/20] tools/rv: Implement BPF monitor loading and tracing Gabriele Monaco
2026-08-31  9:34   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 14/20] tools/rv: Implement BPF monitor registration logic Gabriele Monaco
2026-08-31  9:38   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 15/20] tools/rv: Copy stripped bpf_atomic.h from libarena Gabriele Monaco
2026-08-31  9:38   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 16/20] tools/rv: Add BPF monitors Gabriele Monaco
2026-08-31  9:40   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 17/20] tools/rv: Define CONFIG_X86_64 statically for " Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 18/20] verification/rvgen: Add support " Gabriele Monaco
2026-08-31  9:41   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 19/20] tools/rv: Add selftest for rv bpf Gabriele Monaco
2026-08-31  9:44   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 20/20] verification/rvgen: Add selftest for rvgen -b Gabriele Monaco
2026-09-01 18:35 ` [RFC PATCH 00/20] rv: Add support for BPF monitors Nam Cao
2026-09-02  6:52   ` Gabriele Monaco
2026-09-02  7:46     ` Nam Cao
2026-09-03  1:57     ` Alexei Starovoitov
2026-09-03  7:21       ` Gabriele Monaco
2026-09-03 13:02         ` Steven Rostedt
2026-09-04  3:30           ` Alexei Starovoitov
2026-09-04 11:43             ` Steven Rostedt
2026-09-04 16:16               ` Alexei Starovoitov
2026-09-04 16:31                 ` Steven Rostedt
2026-09-04 17:24                   ` Steven Rostedt
2026-09-04 23:34                     ` Alexei Starovoitov
2026-09-04 23:46                       ` Steven Rostedt
2026-09-04 23:48                         ` Alexei Starovoitov
2026-09-05  0:17                           ` Steven Rostedt
2026-09-05  0:22                             ` Alexei Starovoitov
2026-09-05  4:53                               ` Gabriele Monaco
2026-09-13  1:26                                 ` Alexei Starovoitov
2026-09-04 11:23       ` Tomas Glozar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260831092405.931CF1F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=gmonaco@redhat.com \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.