Re: [PATCH bpf-next v2 2/5] bpf: Preserve unique-field state across nested structs

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Sun Jul 19, 2026 at 5:49 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Multiple BPF_REFCOUNT fields in a BTF struct bypass the seen_mask uniqueness check because is_unique = false, allowing them to trigger a reachable WARN_ON_ONCE() in btf_parse_fields().
> --
>
> --- Patch [2]: [PATCH bpf-next v2 2/5] bpf: Preserve unique-field state across nested structs ---
> commit f8de1a7879c048283531a81778eac42891723a9d
> Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
> bpf: Preserve unique-field state across nested structs
>
> btf_find_struct_field() initializes a fresh seen mask for every recursive
> descent. This commit passes a shared seen mask pointer through the entire
> field traversal to ensure unique special fields in different levels of the
> same aggregate properly see one another.
>
>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> index e7d4e9ba24e26..c577f00e9d885 100644
>> --- a/kernel/bpf/btf.c
>> +++ b/kernel/bpf/btf.c
>
> [ ... ]
>
>> @@ -3947,10 +3947,12 @@ static int btf_find_field(const struct btf *btf, const struct btf_type *t,
>>  			  u32 field_mask, struct btf_field_info *info,
>>  			  int info_cnt)
>>  {
>> +	u32 seen_mask = 0;
>> +
>>  	if (__btf_type_is_struct(t))
>> -		return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0);
>> +		return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0, &seen_mask);
>
> [Severity: High]
> This is a pre-existing issue, but since this patch improves the uniqueness
> tracking via seen_mask, should BPF_REFCOUNT also be treated as a unique field?
>
> In btf_get_field_type(), BPF_REFCOUNT is currently defined with
> is_unique = false:
>
>     { BPF_REFCOUNT, "bpf_refcount", false },
>
> Because it bypasses the uniqueness validation, a user could load a BTF struct
> containing multiple bpf_refcount fields. If this happens, does it eventually
> reach btf_parse_fields() and intentionally trigger the WARN_ON_ONCE there?
>
>     case BPF_REFCOUNT:
>         WARN_ON_ONCE(rec->refcount_off >= 0);
>         /* Cache offset for faster lookup at runtime */
>         rec->refcount_off = rec->fields[i].offset;
>         break;
>
> Could a crafted user BTF cause a kernel panic here if panic_on_warn is
> enabled?

Yes, but exactly what next commit fixes.