BPF List
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Gabriele Monaco" <gmonaco@redhat.com>
Cc: linux-trace-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name()
Date: Mon, 31 Aug 2026 09:24:05 +0000	[thread overview]
Message-ID: <20260831092405.931CF1F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260831090524.106845-7-gmonaco@redhat.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] rv_is_container_monitor() fails to identify an empty container if it is the last element in the list, leading to a NULL pointer dereference when enabled.
--

commit a8e1e1f414fc69c200ed8ba3fee4d10346fe86df
Author: Gabriele Monaco <gmonaco@redhat.com>

rv: Add rv_get_monitor_by_name()
    
Add a helper function to get the rv_monitor pointer for a registered
monitor given its name and add its first user in rv_register_monitor().

> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> index f77c5865f41ab..33919c5fbd6ad 100644
> --- a/kernel/trace/rv/rv.c
> +++ b/kernel/trace/rv/rv.c
[ ... ]
> @@ -229,6 +230,18 @@ bool rv_is_container_monitor(struct rv_monitor *mon)
>  	return next->parent == mon || !mon->enable;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing
issue in rv_is_container_monitor(). Does this function incorrectly classify
an empty container monitor if it happens to be the last element in
rv_monitors_list?

Looking at the rest of rv_is_container_monitor():

bool rv_is_container_monitor(struct rv_monitor *mon)
{
	...
	if (list_is_last(&mon->list, &rv_monitors_list))
		return false;

	next = list_next_entry(mon, list);
	return next->parent == mon || !mon->enable;
}

If an empty container monitor (which has a NULL enable function) is the last
element, it returns false early. This bypasses the !mon->enable check,
treating the empty container as a regular monitor.

If a user then writes to its tracefs enable file, rv_enable_single() appears
to unconditionally call the enable function:

	retval = mon->enable();

Since the empty container monitor has a NULL enable pointer, will this lead
to a kernel panic via a NULL pointer dereference when enabled?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831090524.106845-1-gmonaco@redhat.com?part=6

  reply	other threads:[~2026-08-31  9:24 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-31  9:05 [RFC PATCH 00/20] rv: Add support for BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 01/20] sched: Add task enqueue/dequeue trace points Gabriele Monaco
2026-08-31  9:32   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 02/20] tools/rv: Skip empty pid error in selftest if command failed Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 03/20] rv: Refactor da_trace() functions to get strings internally Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 04/20] rv: Use static arrays for rv_monitor name and description Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 05/20] rv: Add in-kernel support for BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 06/20] rv: Add rv_get_monitor_by_name() Gabriele Monaco
2026-08-31  9:24   ` sashiko-bot [this message]
2026-08-31  9:05 ` [RFC PATCH 07/20] rv: Add reactors support to BPF monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 08/20] rv: Cast result of model_get_*_name() Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 09/20] rv: Handle unregistered monitors safely in tracefs Gabriele Monaco
2026-08-31  9:24   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 10/20] tools/build: Add a feature test for bpftool-btf Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 11/20] tools/rv: Move argument parsing from in_kernel to utils Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 12/20] tools/rv: Export functionality for in_kernel monitors Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 13/20] tools/rv: Implement BPF monitor loading and tracing Gabriele Monaco
2026-08-31  9:34   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 14/20] tools/rv: Implement BPF monitor registration logic Gabriele Monaco
2026-08-31  9:38   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 15/20] tools/rv: Copy stripped bpf_atomic.h from libarena Gabriele Monaco
2026-08-31  9:38   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 16/20] tools/rv: Add BPF monitors Gabriele Monaco
2026-08-31  9:40   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 17/20] tools/rv: Define CONFIG_X86_64 statically for " Gabriele Monaco
2026-08-31  9:05 ` [RFC PATCH 18/20] verification/rvgen: Add support " Gabriele Monaco
2026-08-31  9:41   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 19/20] tools/rv: Add selftest for rv bpf Gabriele Monaco
2026-08-31  9:44   ` sashiko-bot
2026-08-31  9:05 ` [RFC PATCH 20/20] verification/rvgen: Add selftest for rvgen -b Gabriele Monaco
2026-09-01 18:35 ` [RFC PATCH 00/20] rv: Add support for BPF monitors Nam Cao
2026-09-02  6:52   ` Gabriele Monaco
2026-09-02  7:46     ` Nam Cao
2026-09-03  1:57     ` Alexei Starovoitov
2026-09-03  7:21       ` Gabriele Monaco
2026-09-03 13:02         ` Steven Rostedt
2026-09-04  3:30           ` Alexei Starovoitov
2026-09-04 11:23       ` Tomas Glozar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260831092405.931CF1F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=gmonaco@redhat.com \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox