Re: [PATCH bpf-next v2 1/5] bpf: Fix offset warn check for bpf_res_spin_lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Userspace-triggerable kernel warning (WARN_ON_ONCE) due to nested struct bypassing `seen_mask` uniqueness check, potentially leading to kernel panic.
--

--- Patch [1]: [PATCH bpf-next v2 1/5] bpf: Fix offset warn check for bpf_res_spin_lock ---
commit f617fbd9a79f403f8e8be07c38922dcd0eedd840
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Fix offset warn check for bpf_res_spin_lock

This commit fixes an incorrect offset check for BPF_RES_SPIN_LOCK in
btf_parse_fields(). It now correctly checks res_spin_lock_off instead of
spin_lock_off.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index cbb1e49b9bcbf..e7d4e9ba24e26 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4168,7 +4168,7 @@ struct btf_record *btf_parse_fields(const struct btf *btf, const struct btf_type
>  			rec->spin_lock_off = rec->fields[i].offset;
>  			break;
>  		case BPF_RES_SPIN_LOCK:
> -			WARN_ON_ONCE(rec->spin_lock_off >= 0);
> +			WARN_ON_ONCE(rec->res_spin_lock_off >= 0);

[Severity: High]
This is a pre-existing issue, but could this WARN_ON_ONCE() be triggered
from userspace and cause a kernel panic on systems with panic_on_warn
enabled?

If a crafted BTF with multiple identical unique fields (like
BPF_RES_SPIN_LOCK) is provided in different nested structures, it appears
btf_find_struct_field() resets seen_mask to 0 for each nested level:

kernel/bpf/btf.c:btf_find_struct_field() {
	u32 i, off, seen_mask = 0;
	...
}

This could allow duplicate unique fields to bypass the seen_mask check and
be returned to btf_parse_fields(). When iterating over these duplicates
here, would it hit this WARN_ON_ONCE() and panic the system? Should we
return an error instead of warning, or pass seen_mask down during the
recursive struct traversal to prevent this?

>  			/* Cache offset for faster lookup at runtime */
>  			rec->res_spin_lock_off = rec->fields[i].offset;
>  			break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260719153634.2908692-1-memxor@gmail.com?part=1