Re: [PATCH 03/12] tracing/probes: Fix BTF bitfield parsing and out-of-bounds buffer write

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] tracing/probes: unaligned kflag=0 bitfields fail in
  get_bitoffset_of_field()
--

commit 2e4831ec2095ef67023431da46d322fba9d204db
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>

tracing/probes: Fix BTF bitfield parsing and out-of-bounds buffer write

This commit fixes BTF bitfield offset calculation, selects an unsigned fetch
type wide enough to cover the bit offset and width, and derives the
FETCH_OP_MOD_BF shift and basesize parameters from the selected fetch type.

> diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> index a880a90642d7c..26e02929f1ffb 100644
> --- a/kernel/trace/trace_probe.c
> +++ b/kernel/trace/trace_probe.c

[ ... ]

> @@ -653,6 +661,12 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  		/* Add anonymous structure/union offset */
>  		bitoffs += anon_offs;
>  
> +		type = btf_type_skip_modifiers(btf, field->type, NULL);
> +		if (!type) {
> +			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> +			return -EINVAL;
> +		}
> +
>  		/* Accumulate the bit-offsets of the dot-connected fields */
>  		if (btf_type_kflag(container_type)) {
>  			bitoffs += BTF_MEMBER_BIT_OFFSET(field->offset);
> @@ -660,12 +674,15 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  		} else {
>  			bitoffs += field->offset;
>  			ctx->last_bitsize = 0;
> -		}
> +			if (BTF_INFO_KIND(type->info) == BTF_KIND_INT) {
> +				u32 intdata = btf_type_int(type);
>  
> -		type = btf_type_skip_modifiers(btf, field->type, NULL);
> -		if (!type) {
> -			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> -			return -EINVAL;
> +				if (BTF_INT_OFFSET(intdata) ||
> +				    BTF_INT_BITS(intdata) != BYTES_TO_BITS(type->size)) {
> +					bitoffs += BTF_INT_OFFSET(intdata);
> +					ctx->last_bitsize = BTF_INT_BITS(intdata);
> +				}
> +			}
>  		}

[Severity: Medium]
Does this leave ctx->last_bitsize as 0 when a kflag=0 bitfield has a bit
width matching its underlying integer type size (such as an 8-bit bitfield
backed by a 1-byte BTF_KIND_INT with BTF_INT_OFFSET(intdata) == 0) at a
non-byte-aligned member offset (bitoffs % 8 != 0)?

When that happens, parse_btf_field() sets a non-zero ctx->last_bitoffs while
ctx->last_bitsize remains 0.  fetch_type_from_btf_type() then does not widen
the fetch type to cover the unaligned field across the byte boundary, and
parse_btf_bitfield() rejects the probe with BAD_BITFIELD (-EINVAL) because
ctx->last_bitsize == 0 while ctx->last_bitoffs != 0.

Checking bitoffs % 8 != 0 alongside BTF_INT_OFFSET(intdata) and
BTF_INT_BITS(intdata) != BYTES_TO_BITS(type->size) would record
ctx->last_bitsize for unaligned byte-sized kflag=0 bitfields as well.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179418408457.227715.1485179201014819821.stgit@devnote2?part=3