Re: [PATCH bpf-next v2 2/5] bpf: Preserve unique-field state across nested structs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Multiple BPF_REFCOUNT fields in a BTF struct bypass the seen_mask uniqueness check because is_unique = false, allowing them to trigger a reachable WARN_ON_ONCE() in btf_parse_fields().
--

--- Patch [2]: [PATCH bpf-next v2 2/5] bpf: Preserve unique-field state across nested structs ---
commit f8de1a7879c048283531a81778eac42891723a9d
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Preserve unique-field state across nested structs

btf_find_struct_field() initializes a fresh seen mask for every recursive
descent. This commit passes a shared seen mask pointer through the entire
field traversal to ensure unique special fields in different levels of the
same aggregate properly see one another.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index e7d4e9ba24e26..c577f00e9d885 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c

[ ... ]

> @@ -3947,10 +3947,12 @@ static int btf_find_field(const struct btf *btf, const struct btf_type *t,
>  			  u32 field_mask, struct btf_field_info *info,
>  			  int info_cnt)
>  {
> +	u32 seen_mask = 0;
> +
>  	if (__btf_type_is_struct(t))
> -		return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0);
> +		return btf_find_struct_field(btf, t, field_mask, info, info_cnt, 0, &seen_mask);

[Severity: High]
This is a pre-existing issue, but since this patch improves the uniqueness
tracking via seen_mask, should BPF_REFCOUNT also be treated as a unique field?

In btf_get_field_type(), BPF_REFCOUNT is currently defined with
is_unique = false:

    { BPF_REFCOUNT, "bpf_refcount", false },

Because it bypasses the uniqueness validation, a user could load a BTF struct
containing multiple bpf_refcount fields. If this happens, does it eventually
reach btf_parse_fields() and intentionally trigger the WARN_ON_ONCE there?

    case BPF_REFCOUNT:
        WARN_ON_ONCE(rec->refcount_off >= 0);
        /* Cache offset for faster lookup at runtime */
        rec->refcount_off = rec->fields[i].offset;
        break;

Could a crafted user BTF cause a kernel panic here if panic_on_warn is
enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260719153634.2908692-1-memxor@gmail.com?part=2