[PATCH 0/2] tracing/probes: Fix BTF structure member finder

[PATCH 0/2] tracing/probes: Fix BTF structure member finder

[Masami Hiramatsu (Google)]

Hi,

This is a series of fixes for the BTF structure member finder in trace_btf.c
Sashiko found 2 problems in it during reviewing the wprobe series.[1][2]
I decided to pick those fixes as independent fix series.
[1] https://lore.kernel.org/all/20260822095110.0772E1F000E9@smtp.kernel.org/
[2] https://lore.kernel.org/all/20260830143859.D56991F00A3D@smtp.kernel.org/

 - [1/2] btf_find_struct_member() did not consider unnamed bitfields.
   Fix it to skip such unnamed bitfields from nested struct search.
 - [2/2] get_bitoffset_of_field() wrongly checks the field's
   type->kflag for offset encoding. It should check the member's
   type->kflag instead. Thus it adds member_type out-parameter to
   btf_find_struct_member() to get the member's type information
   and use it.

Thanks,

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935

Masami Hiramatsu (Google) (2):
      tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
      tracing/probes: Fix BTF kflag check for anonymous struct member access


 kernel/trace/trace_btf.c   |   31 +++++++++++++++++--------------
 kernel/trace/trace_btf.h   |    3 ++-
 kernel/trace/trace_probe.c |   15 ++++++++-------
 3 files changed, 27 insertions(+), 22 deletions(-)

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH 1/2] tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

btf_find_struct_member() traverses into nested anonymous structures
and unions by pushing members with !member->name_off onto anon_stack.
However, it does not consider the unnamed bitfields (e.g. `int : 5`
or `unsigned int : 0`) which also have member->name_off == 0.

If such an unnamed bitfield is pushed to anon_stack, the
btf_find_struct_member() return an error even if there are other
valid entries in anon_stack.

To fix this, only push unnamed struct/union members to anon_stack.
Also move the btf_type_is_struct() check to the entry of this function
because now it is sure only struct/union are pushed to anon_stack.

Fixes: 302db0f5b3d8 ("tracing/probes: Add a function to search a member of a struct/union")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 kernel/trace/trace_btf.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c
index 00172f301f25..d3ba356d5503 100644
--- a/kernel/trace/trace_btf.c
+++ b/kernel/trace/trace_btf.c
@@ -74,24 +74,24 @@ const struct btf_member *btf_find_struct_member(struct btf *btf,
 {
 	struct btf_anon_stack *anon_stack;
 	const struct btf_member *member;
+	const struct btf_type *mtype;
 	u32 tid, cur_offset = 0;
 	const char *name;
 	int i, top = 0;
 
+	if (!btf_type_is_struct(type))
+		return ERR_PTR(-EINVAL);
+
 	anon_stack = kzalloc_objs(*anon_stack, BTF_ANON_STACK_MAX);
 	if (!anon_stack)
 		return ERR_PTR(-ENOMEM);
 
 retry:
-	if (!btf_type_is_struct(type)) {
-		member = ERR_PTR(-EINVAL);
-		goto out;
-	}
-
 	for_each_member(i, type, member) {
 		if (!member->name_off) {
 			/* Anonymous union/struct: push it for later use */
-			if (btf_type_skip_modifiers(btf, member->type, &tid) &&
+			mtype = btf_type_skip_modifiers(btf, member->type, &tid);
+			if (mtype && btf_type_is_struct(mtype) &&
 			    top < BTF_ANON_STACK_MAX) {
 				anon_stack[top].tid = tid;
 				anon_stack[top++].offset =

Re: [PATCH 1/2] tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member

[Steven Rostedt]

On Tue,  1 Sep 2026 00:06:05 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> btf_find_struct_member() traverses into nested anonymous structures
> and unions by pushing members with !member->name_off onto anon_stack.
> However, it does not consider the unnamed bitfields (e.g. `int : 5`
> or `unsigned int : 0`) which also have member->name_off == 0.
> 
> If such an unnamed bitfield is pushed to anon_stack, the
> btf_find_struct_member() return an error even if there are other
> valid entries in anon_stack.
> 
> To fix this, only push unnamed struct/union members to anon_stack.
> Also move the btf_type_is_struct() check to the entry of this function
> because now it is sure only struct/union are pushed to anon_stack.
> 

Should we add Reported-by and a link to the Sashiko report?

> Fixes: 302db0f5b3d8 ("tracing/probes: Add a function to search a member of a struct/union")
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Reviewed-by: Steven Rostedt <rostedt@goodmis.org>

-- Steve

Re: [PATCH 1/2] tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member

[Masami Hiramatsu]

On Mon, 31 Aug 2026 13:01:33 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Tue,  1 Sep 2026 00:06:05 +0900
> "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> 
> > From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> > 
> > btf_find_struct_member() traverses into nested anonymous structures
> > and unions by pushing members with !member->name_off onto anon_stack.
> > However, it does not consider the unnamed bitfields (e.g. `int : 5`
> > or `unsigned int : 0`) which also have member->name_off == 0.
> > 
> > If such an unnamed bitfield is pushed to anon_stack, the
> > btf_find_struct_member() return an error even if there are other
> > valid entries in anon_stack.
> > 
> > To fix this, only push unnamed struct/union members to anon_stack.
> > Also move the btf_type_is_struct() check to the entry of this function
> > because now it is sure only struct/union are pushed to anon_stack.
> > 
> 
> Should we add Reported-by and a link to the Sashiko report?

Ah, good point! Let me add it (and I forgot Cc: stable)

> 
> > Fixes: 302db0f5b3d8 ("tracing/probes: Add a function to search a member of a struct/union")
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> Reviewed-by: Steven Rostedt <rostedt@goodmis.org>

Thanks!

> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH 2/2] tracing/probes: Fix BTF kflag check for anonymous struct member access

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

btf_find_struct_member() traverses into nested anonymous structures and
unions to find a struct member. However, get_bitoffset_of_field() in
trace_probe.c checked btf_type_kflag(type) using the outer parent type
instead of the actual anonymous structure/union that directly contains
the found member.

If the parent structure and anonymous structure have mismatched kflags
(e.g., the parent has kflag=0 while the anonymous structure has kflag=1
because it contains bitfields), the bitfield size encoded in the upper
8 bits of member->offset is erroneously treated as part of the byte/bit
offset, corrupting the resolved offset and failing to set last_bitsize.
Similarly, btf_find_struct_member() pushed anonymous member offsets
onto anon_stack without masking BTF_MEMBER_BIT_OFFSET() when kflag is set.

To fix this problem, update btf_find_struct_member() to return actual
containing structure/union type via member_type, use appropriate
__btf_member_bit_offset() to get bit offset, and use member_type for
btf_type_kflag() in get_bitoffset_of_field().

Fixes: c440adfbe302 ("tracing/probes: Support BTF based data structure field access")
Assisted-by: Antigravity:gemini-3.7-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 This is separated from wprobe patch series v14.
 - https://lore.kernel.org/all/178810003326.64882.5820404025124695636.stgit@devnote2/
---
 kernel/trace/trace_btf.c   |   19 +++++++++++--------
 kernel/trace/trace_btf.h   |    3 ++-
 kernel/trace/trace_probe.c |   15 ++++++++-------
 3 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/kernel/trace/trace_btf.c b/kernel/trace/trace_btf.c
index d3ba356d5503..ee7a04886bf6 100644
--- a/kernel/trace/trace_btf.c
+++ b/kernel/trace/trace_btf.c
@@ -61,16 +61,17 @@ struct btf_anon_stack {
 
 /*
  * Find a member of data structure/union by name and return it.
- * Return NULL if not found, or -EINVAL if parameter is invalid.
- * If the member is an member of anonymous union/structure, the offset
- * of that anonymous union/structure is stored into @anon_offset. Caller
- * can calculate the correct offset from the root data structure by
- * adding anon_offset to the member's offset.
+ * Return NULL if not found, or ERR_PTR(-EINVAL) if parameter is invalid.
+ * If the member is a member of an anonymous union/structure, the bit offset
+ * of that anonymous union/structure is stored into @anon_offset.
+ * If @member_type is non-NULL, the actual containing structure/union type
+ * of the found member is stored into @member_type.
  */
 const struct btf_member *btf_find_struct_member(struct btf *btf,
 						const struct btf_type *type,
 						const char *member_name,
-						u32 *anon_offset)
+						u32 *anon_offset,
+						const struct btf_type **member_type)
 {
 	struct btf_anon_stack *anon_stack;
 	const struct btf_member *member;
@@ -94,14 +95,16 @@ const struct btf_member *btf_find_struct_member(struct btf *btf,
 			if (mtype && btf_type_is_struct(mtype) &&
 			    top < BTF_ANON_STACK_MAX) {
 				anon_stack[top].tid = tid;
-				anon_stack[top++].offset =
-					cur_offset + member->offset;
+				anon_stack[top++].offset = cur_offset +
+					__btf_member_bit_offset(type, member);
 			}
 		} else {
 			name = btf_name_by_offset(btf, member->name_off);
 			if (name && !strcmp(member_name, name)) {
 				if (anon_offset)
 					*anon_offset = cur_offset;
+				if (member_type)
+					*member_type = type;
 				goto out;
 			}
 		}
diff --git a/kernel/trace/trace_btf.h b/kernel/trace/trace_btf.h
index 4bc44bc261e6..4bd26bceae23 100644
--- a/kernel/trace/trace_btf.h
+++ b/kernel/trace/trace_btf.h
@@ -8,4 +8,5 @@ const struct btf_param *btf_get_func_param(const struct btf_type *func_proto,
 const struct btf_member *btf_find_struct_member(struct btf *btf,
 						const struct btf_type *type,
 						const char *member_name,
-						u32 *anon_offset);
+						u32 *anon_offset,
+						const struct btf_type **member_type);
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index c4163904ba74..ce2a7bb00d28 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -625,6 +625,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
 {
 	const struct btf_type *type = *ptype;
 	const struct btf_member *field;
+	const struct btf_type *mtype = NULL;
 	struct btf *btf = ctx_btf(ctx);
 	char *fieldname = *pfieldname;
 	int bitoffs = 0;
@@ -640,7 +641,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
 
 		anon_offs = 0;
 		field = btf_find_struct_member(btf, type, fieldname,
-						&anon_offs);
+						&anon_offs, &mtype);
 		if (IS_ERR(field)) {
 			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
 			return PTR_ERR(field);
@@ -653,7 +654,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
 		bitoffs += anon_offs;
 
 		/* Accumulate the bit-offsets of the dot-connected fields */
-		if (btf_type_kflag(type)) {
+		if (btf_type_kflag(mtype)) {
 			bitoffs += BTF_MEMBER_BIT_OFFSET(field->offset);
 			ctx->last_bitsize = BTF_MEMBER_BITFIELD_SIZE(field->offset);
 		} else {
@@ -661,11 +662,11 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
 			ctx->last_bitsize = 0;
 		}
 
-			type = btf_type_skip_modifiers(btf, field->type, NULL);
-			if (!type) {
-				trace_probe_log_err(ctx->offset, BAD_BTF_TID);
-				return -EINVAL;
-			}
+		type = btf_type_skip_modifiers(btf, field->type, NULL);
+		if (!type) {
+			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
+			return -EINVAL;
+		}
 
 		if (next)
 			ctx->offset += next - fieldname;

Re: [PATCH 2/2] tracing/probes: Fix BTF kflag check for anonymous struct member access

[Steven Rostedt]

On Tue,  1 Sep 2026 00:06:16 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> diff --git a/kernel/trace/trace_btf.h b/kernel/trace/trace_btf.h
> index 4bc44bc261e6..4bd26bceae23 100644
> --- a/kernel/trace/trace_btf.h
> +++ b/kernel/trace/trace_btf.h
> @@ -8,4 +8,5 @@ const struct btf_param *btf_get_func_param(const struct btf_type *func_proto,
>  const struct btf_member *btf_find_struct_member(struct btf *btf,
>  						const struct btf_type *type,
>  						const char *member_name,
> -						u32 *anon_offset);
> +						u32 *anon_offset,
> +						const struct btf_type **member_type);
> diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> index c4163904ba74..ce2a7bb00d28 100644
> --- a/kernel/trace/trace_probe.c
> +++ b/kernel/trace/trace_probe.c
> @@ -625,6 +625,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  {
>  	const struct btf_type *type = *ptype;
>  	const struct btf_member *field;
> +	const struct btf_type *mtype = NULL;

Why initialize mtype to NULL?

>  	struct btf *btf = ctx_btf(ctx);
>  	char *fieldname = *pfieldname;
>  	int bitoffs = 0;
> @@ -640,7 +641,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  
>  		anon_offs = 0;
>  		field = btf_find_struct_member(btf, type, fieldname,
> -						&anon_offs);
> +						&anon_offs, &mtype);

If mtype is not set here, then field would be either an error or NULL.

>  		if (IS_ERR(field)) {
>  			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
>  			return PTR_ERR(field);

If field is an error or NULL, it exits out early.

> @@ -653,7 +654,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  		bitoffs += anon_offs;
>  
>  		/* Accumulate the bit-offsets of the dot-connected fields */
> -		if (btf_type_kflag(type)) {
> +		if (btf_type_kflag(mtype)) {

mtype should be guaranteed as set here (maybe set to NULL, but set regardless)

Now, if btf_find_struct_member() did not set mtype, because this is in a
loop, in a second iteration, mtype would be stale.

So either set it to NULL at the top of the loop, or don't set it at all.

Or am I missing something?

-- Steve



>  			bitoffs += BTF_MEMBER_BIT_OFFSET(field->offset);
>  			ctx->last_bitsize = BTF_MEMBER_BITFIELD_SIZE(field->offset);
>  		} else {
> @@ -661,11 +662,11 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
>  			ctx->last_bitsize = 0;
>  		}
>  
> -			type = btf_type_skip_modifiers(btf, field->type, NULL);
> -			if (!type) {
> -				trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> -				return -EINVAL;
> -			}
> +		type = btf_type_skip_modifiers(btf, field->type, NULL);
> +		if (!type) {
> +			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> +			return -EINVAL;
> +		}
>  
>  		if (next)
>  			ctx->offset += next - fieldname;

Re: [PATCH 2/2] tracing/probes: Fix BTF kflag check for anonymous struct member access

[Masami Hiramatsu]

On Mon, 31 Aug 2026 13:14:29 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Tue,  1 Sep 2026 00:06:16 +0900
> "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> > diff --git a/kernel/trace/trace_btf.h b/kernel/trace/trace_btf.h
> > index 4bc44bc261e6..4bd26bceae23 100644
> > --- a/kernel/trace/trace_btf.h
> > +++ b/kernel/trace/trace_btf.h
> > @@ -8,4 +8,5 @@ const struct btf_param *btf_get_func_param(const struct btf_type *func_proto,
> >  const struct btf_member *btf_find_struct_member(struct btf *btf,
> >  						const struct btf_type *type,
> >  						const char *member_name,
> > -						u32 *anon_offset);
> > +						u32 *anon_offset,
> > +						const struct btf_type **member_type);
> > diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> > index c4163904ba74..ce2a7bb00d28 100644
> > --- a/kernel/trace/trace_probe.c
> > +++ b/kernel/trace/trace_probe.c
> > @@ -625,6 +625,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
> >  {
> >  	const struct btf_type *type = *ptype;
> >  	const struct btf_member *field;
> > +	const struct btf_type *mtype = NULL;
> 
> Why initialize mtype to NULL?
> 
> >  	struct btf *btf = ctx_btf(ctx);
> >  	char *fieldname = *pfieldname;
> >  	int bitoffs = 0;
> > @@ -640,7 +641,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
> >  
> >  		anon_offs = 0;
> >  		field = btf_find_struct_member(btf, type, fieldname,
> > -						&anon_offs);
> > +						&anon_offs, &mtype);
> 
> If mtype is not set here, then field would be either an error or NULL.
> 
> >  		if (IS_ERR(field)) {
> >  			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> >  			return PTR_ERR(field);
> 
> If field is an error or NULL, it exits out early.
> 
> > @@ -653,7 +654,7 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
> >  		bitoffs += anon_offs;
> >  
> >  		/* Accumulate the bit-offsets of the dot-connected fields */
> > -		if (btf_type_kflag(type)) {
> > +		if (btf_type_kflag(mtype)) {
> 
> mtype should be guaranteed as set here (maybe set to NULL, but set regardless)
> 
> Now, if btf_find_struct_member() did not set mtype, because this is in a
> loop, in a second iteration, mtype would be stale.

Ah, indeed!

> 
> So either set it to NULL at the top of the loop, or don't set it at all.
> 
> Or am I missing something?

OK, let me just drop NULL initialization because it is a kind of hardening.
(Since anon_offs is left uninitialized, mtype = NULL seems somewhat unbalanced.)

Thanks!

> 
> -- Steve
> 
> 
> 
> >  			bitoffs += BTF_MEMBER_BIT_OFFSET(field->offset);
> >  			ctx->last_bitsize = BTF_MEMBER_BITFIELD_SIZE(field->offset);
> >  		} else {
> > @@ -661,11 +662,11 @@ static int get_bitoffset_of_field(char **pfieldname, const struct btf_type **pty
> >  			ctx->last_bitsize = 0;
> >  		}
> >  
> > -			type = btf_type_skip_modifiers(btf, field->type, NULL);
> > -			if (!type) {
> > -				trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> > -				return -EINVAL;
> > -			}
> > +		type = btf_type_skip_modifiers(btf, field->type, NULL);
> > +		if (!type) {
> > +			trace_probe_log_err(ctx->offset, BAD_BTF_TID);
> > +			return -EINVAL;
> > +		}
> >  
> >  		if (next)
> >  			ctx->offset += next - fieldname;
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>