From: sashiko-bot@kernel.org
To: "Gabriele Monaco" <gmonaco@redhat.com>
Cc: linux-trace-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name()
Date: Mon, 31 Aug 2026 09:24:05 +0000 [thread overview]
Message-ID: <20260831092405.931CF1F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260831090524.106845-7-gmonaco@redhat.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] rv_is_container_monitor() fails to identify an empty container if it is the last element in the list, leading to a NULL pointer dereference when enabled.
--
commit a8e1e1f414fc69c200ed8ba3fee4d10346fe86df
Author: Gabriele Monaco <gmonaco@redhat.com>
rv: Add rv_get_monitor_by_name()
Add a helper function to get the rv_monitor pointer for a registered
monitor given its name and add its first user in rv_register_monitor().
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> index f77c5865f41ab..33919c5fbd6ad 100644
> --- a/kernel/trace/rv/rv.c
> +++ b/kernel/trace/rv/rv.c
[ ... ]
> @@ -229,6 +230,18 @@ bool rv_is_container_monitor(struct rv_monitor *mon)
> return next->parent == mon || !mon->enable;
> }
[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing
issue in rv_is_container_monitor(). Does this function incorrectly classify
an empty container monitor if it happens to be the last element in
rv_monitors_list?
Looking at the rest of rv_is_container_monitor():
bool rv_is_container_monitor(struct rv_monitor *mon)
{
...
if (list_is_last(&mon->list, &rv_monitors_list))
return false;
next = list_next_entry(mon, list);
return next->parent == mon || !mon->enable;
}
If an empty container monitor (which has a NULL enable function) is the last
element, it returns false early. This bypasses the !mon->enable check,
treating the empty container as a regular monitor.
If a user then writes to its tracefs enable file, rv_enable_single() appears
to unconditionally call the enable function:
retval = mon->enable();
Since the empty container monitor has a NULL enable pointer, will this lead
to a kernel panic via a NULL pointer dereference when enabled?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260831090524.106845-1-gmonaco@redhat.com?part=6
next prev parent reply other threads:[~2026-08-31 9:24 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-31 9:05 [RFC PATCH 00/20] rv: Add support for BPF monitors Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 01/20] sched: Add task enqueue/dequeue trace points Gabriele Monaco
2026-08-31 9:32 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 02/20] tools/rv: Skip empty pid error in selftest if command failed Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 03/20] rv: Refactor da_trace() functions to get strings internally Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 04/20] rv: Use static arrays for rv_monitor name and description Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 05/20] rv: Add in-kernel support for BPF monitors Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name() Gabriele Monaco
2026-08-31 9:24 ` sashiko-bot [this message]
2026-08-31 9:05 ` [RFC PATCH 07/20] rv: Add reactors support to BPF monitors Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 08/20] rv: Cast result of model_get_*_name() Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 09/20] rv: Handle unregistered monitors safely in tracefs Gabriele Monaco
2026-08-31 9:24 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 10/20] tools/build: Add a feature test for bpftool-btf Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 11/20] tools/rv: Move argument parsing from in_kernel to utils Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 12/20] tools/rv: Export functionality for in_kernel monitors Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 13/20] tools/rv: Implement BPF monitor loading and tracing Gabriele Monaco
2026-08-31 9:34 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 14/20] tools/rv: Implement BPF monitor registration logic Gabriele Monaco
2026-08-31 9:38 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 15/20] tools/rv: Copy stripped bpf_atomic.h from libarena Gabriele Monaco
2026-08-31 9:38 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 16/20] tools/rv: Add BPF monitors Gabriele Monaco
2026-08-31 9:40 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 17/20] tools/rv: Define CONFIG_X86_64 statically for " Gabriele Monaco
2026-08-31 9:05 ` [RFC PATCH 18/20] verification/rvgen: Add support " Gabriele Monaco
2026-08-31 9:41 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 19/20] tools/rv: Add selftest for rv bpf Gabriele Monaco
2026-08-31 9:44 ` sashiko-bot
2026-08-31 9:05 ` [RFC PATCH 20/20] verification/rvgen: Add selftest for rvgen -b Gabriele Monaco
2026-09-01 18:35 ` [RFC PATCH 00/20] rv: Add support for BPF monitors Nam Cao
2026-09-02 6:52 ` Gabriele Monaco
2026-09-02 7:46 ` Nam Cao
2026-09-03 1:57 ` Alexei Starovoitov
2026-09-03 7:21 ` Gabriele Monaco
2026-09-03 13:02 ` Steven Rostedt
2026-09-04 3:30 ` Alexei Starovoitov
2026-09-04 11:23 ` Tomas Glozar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260831092405.931CF1F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=gmonaco@redhat.com \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox