[RFC PATCH v2 0/3] btrfs: add error injection support for checksum verification

[RFC PATCH v2 0/3] btrfs: add error injection support for checksum verification

[Song Chen]

This patchset adds fault injection support for btrfs_data_csum_ok,
enabling controlled simulation of checksum mismatches to test btrfs
silent data corruption detection and reporting paths.

The first patch extends the error injection framework with a new type,
EI_ETYPE_FALSE, which allows bool-returning functions to be overridden
with a false return value directly.

The second patch marks btrfs_data_csum_ok with ALLOW_ERROR_INJECTION
using this new type.

The third patch adds a parent field to fei_attr to allow fault injection
on a function only when called from a specific parent function. 

Song Chen (3):
  error-injection: Introduce EI_ETYPE_FALSE for fail_function
  btrfs: Allow error injection on btrfs_data_csum_ok
  error-injection: Introduce parent in fei_attr

 arch/arm/lib/error-inject.c           |  6 ++
 arch/arm64/lib/error-inject.c         |  6 ++
 arch/csky/lib/error-inject.c          |  6 ++
 arch/loongarch/lib/error-inject.c     |  6 ++
 arch/powerpc/lib/error-inject.c       |  6 ++
 arch/riscv/lib/error-inject.c         |  6 ++
 arch/s390/lib/error-inject.c          |  6 ++
 arch/x86/lib/error-inject.c           |  6 ++
 fs/btrfs/inode.c                      |  1 +
 include/asm-generic/error-injection.h |  6 ++
 kernel/fail_function.c                | 98 ++++++++++++++++++++++++++-
 11 files changed, 152 insertions(+), 1 deletion(-)

---
changelog:
v1 --- v2:
Add a parent field to struct fei_attr.

-- 
2.43.0

[RFC PATCH v2 1/3] error-injection: Introduce EI_ETYPE_FALSE for fail_function

[Song Chen]

Introduce EI_ETYPE_FALSE for functions which need false as return
value in their error-injections, like btrfs_data_csum_ok.

EI_ETYPE_NULL can return 0 too but its readability is not good
enough.

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 include/asm-generic/error-injection.h | 1 +
 kernel/fail_function.c                | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/asm-generic/error-injection.h b/include/asm-generic/error-injection.h
index b05253f68eaa..6c399121ab7a 100644
--- a/include/asm-generic/error-injection.h
+++ b/include/asm-generic/error-injection.h
@@ -8,6 +8,7 @@ enum {
 	EI_ETYPE_ERRNO,		/* Return -ERRNO if failure */
 	EI_ETYPE_ERRNO_NULL,	/* Return -ERRNO or NULL if failure */
 	EI_ETYPE_TRUE,		/* Return true if failure */
+	EI_ETYPE_FALSE,		/* Return false if failure */
 };
 
 struct error_injection_entry {
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 2eaf55005f49..90cdad0412cd 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -48,6 +48,8 @@ static unsigned long adjust_error_retval(unsigned long addr, unsigned long retv)
 		break;
 	case EI_ETYPE_TRUE:
 		return 1;
+	case EI_ETYPE_FALSE:
+		return 0;
 	}
 
 	return retv;
-- 
2.43.0

Re: [RFC PATCH v2 1/3] error-injection: Introduce EI_ETYPE_FALSE for fail_function

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The new EI_ETYPE_FALSE error injection type is missing string mapping in lib/error-inject.c and documentation updates, causing debugfs to report '(unknown)'.
--

--- Patch [1]: [RFC PATCH v2 1/3] error-injection: Introduce EI_ETYPE_FALSE for fail_function ---
commit 5374b818d585ee0b9130e232537545cf0e64070a
Author: Song Chen <chensong_2000@126.com>

error-injection: Introduce EI_ETYPE_FALSE for fail_function

This commit introduces a new error injection type, EI_ETYPE_FALSE. It is
intended for functions that require false as a return value during error
injection, such as btrfs_data_csum_ok.

> diff --git a/include/asm-generic/error-injection.h b/include/asm-generic/error-injection.h
> index b05253f68eaa5..6c399121ab7ab 100644
> --- a/include/asm-generic/error-injection.h
> +++ b/include/asm-generic/error-injection.h
> @@ -8,6 +8,7 @@ enum {
>  	EI_ETYPE_ERRNO,		/* Return -ERRNO if failure */
>  	EI_ETYPE_ERRNO_NULL,	/* Return -ERRNO or NULL if failure */
>  	EI_ETYPE_TRUE,		/* Return true if failure */
> +	EI_ETYPE_FALSE,		/* Return false if failure */

[Severity: Medium]
Does this commit miss updating error_type_string() in lib/error-inject.c to
handle the new type?

Currently, error_type_string() maps the other enum values to strings, but
without an update here it appears it will fall through to the default case:

lib/error-inject.c:error_type_string() {
	...
	case EI_ETYPE_TRUE:
		return "TRUE";
	default:
		return "(unknown)";
}

Won't this cause functions annotated with ALLOW_ERROR_INJECTION(..., FALSE)
to display as '(unknown)' in the /sys/kernel/debug/error_injection/list
debugfs file?

Also, should Documentation/fault-injection/fault-injection.rst be updated to
document EI_ETYPE_FALSE alongside EI_ETYPE_TRUE?

>  };
>  
>  struct error_injection_entry {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724021229.47302-1-chensong_2000@126.com?part=1

[RFC PATCH v2 2/3] btrfs: Allow error injection on btrfs_data_csum_ok

[Song Chen]

btrfs_data_csum_ok validates the checksum of a data block
after a read I/O completes. A mismatch between the on-disk
checksum and the one computed from the read data indicates
silent data corruption, which can be caused by bit flips due
to DRAM errors, storage media degradation, or bus transmission
faults.

Testing the error handling path that responds to such
corruption, including any warning output and uspace
notification, normally requires reproducing the hardware
fault, which is not always feasible.

Mark btrfs_data_csum_ok with ALLOW_ERROR_INJECTION so that
the fail_function infrastructure can override its return value
to false, simulating a checksum mismatch without requiring
actual data corruption. This enables validation of the full
error detection and reporting path in a controlled environment.

Usage:
        cd /sys/kernel/debug/fail_function
        echo btrfs_data_csum_ok > inject
        echo 0 > btrfs_data_csum_ok/retval
        echo 100 > probability
        echo N > times

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 fs/btrfs/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 906d5c21ebc4..6be3e920b954 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3574,6 +3574,7 @@ bool btrfs_data_csum_ok(struct btrfs_bio *bbio, struct btrfs_device *dev,
 		memzero_page(phys_to_page(paddrs[i]), offset_in_page(paddrs[i]), step);
 	return false;
 }
+ALLOW_ERROR_INJECTION(btrfs_data_csum_ok, FALSE);
 
 /*
  * Perform a delayed iput on @inode.
-- 
2.43.0

Re: [RFC PATCH v2 2/3] btrfs: Allow error injection on btrfs_data_csum_ok

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The error injection completely bypasses the error reporting and notification logic it is intended to test.
--

--- Patch [2]: [RFC PATCH v2 2/3] btrfs: Allow error injection on btrfs_data_csum_ok ---
commit 1a83f56a9eedee07c1baca182513e1a6c13386dd
Author: Song Chen <chensong_2000@126.com>

btrfs: Allow error injection on btrfs_data_csum_ok

This patch marks btrfs_data_csum_ok with ALLOW_ERROR_INJECTION to allow the
fail_function infrastructure to simulate checksum mismatches. The intent is
to validate error detection and reporting paths in a controlled environment.

> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
[ ... ]
> @@ -3397,6 +3397,7 @@ bool btrfs_data_csum_ok(struct btrfs_bio *bbio, struct btrfs_device *dev,
>  		memzero_page(phys_to_page(paddrs[i]), offset_in_page(paddrs[i]), step);
>  	return false;
>  }
> +ALLOW_ERROR_INJECTION(btrfs_data_csum_ok, FALSE);

[Severity: Medium]
Does this bypass the error reporting logic it is intended to test?

The commit message states: "Testing the error handling path that responds
to such corruption, including any warning output and uspace notification..."

However, when fail_function overrides a function marked with
ALLOW_ERROR_INJECTION, it forces an immediate return without executing any
of the function body. 

This means the actual error reporting section inside btrfs_data_csum_ok()
is entirely skipped:

fs/btrfs/inode.c:btrfs_data_csum_ok() {
    [ ... ]
zeroit:
	btrfs_print_data_csum_error(inode, file_offset, csum, csum_expected,
				    bbio->mirror_num);
	if (dev)
		btrfs_dev_stat_inc_and_print(dev, BTRFS_DEV_STAT_CORRUPTION_ERRS);
    [ ... ]
}

Since the injected error causes the function to return false before this code
is reached, won't this skip the exact warning output and device stat
increments the patch is trying to validate?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724021229.47302-1-chensong_2000@126.com?part=2

[RFC PATCH v2 3/3] error-injection: Introduce parent in fei_attr

[Song Chen]

Add a parent field to fei_attr to allow fault injection on a function
only when called from a specific parent function. This enables more
precise fault injection control, for example, injecting failures into
btrfs_data_csum_ok() only when called from btrfs_check_read_bio(),
not from btrfs_end_repair_bio().

Introduce fei_return_address() in each architecture's error-injection.c
(x86, arm64, riscv, loongarch) to retrieve the return address from
pt_regs in a kprobe handler, following the same pattern as the existing
override_function_with_return(). A new parent debugfs file is added
under /sys/kernel/debug/fail_function/<func>/ to configure the filter.

Usage:
  echo "btrfs_data_csum_ok" > /sys/kernel/debug/fail_function/inject
  echo 0   > /sys/kernel/debug/fail_function/btrfs_data_csum_ok/retval
  echo 100 > /sys/kernel/debug/fail_function/probability
  echo 10  > /sys/kernel/debug/fail_function/times
  echo "btrfs_check_read_bio" > \
      /sys/kernel/debug/fail_function/btrfs_data_csum_ok/parent

  To clear the parent filter:
  echo "" > /sys/kernel/debug/fail_function/btrfs_data_csum_ok/parent

Signed-off-by: Song Chen <chensong_2000@126.com>
---
 arch/arm/lib/error-inject.c           |  6 ++
 arch/arm64/lib/error-inject.c         |  6 ++
 arch/csky/lib/error-inject.c          |  6 ++
 arch/loongarch/lib/error-inject.c     |  6 ++
 arch/powerpc/lib/error-inject.c       |  6 ++
 arch/riscv/lib/error-inject.c         |  6 ++
 arch/s390/lib/error-inject.c          |  6 ++
 arch/x86/lib/error-inject.c           |  6 ++
 include/asm-generic/error-injection.h |  5 ++
 kernel/fail_function.c                | 96 ++++++++++++++++++++++++++-
 10 files changed, 148 insertions(+), 1 deletion(-)

diff --git a/arch/arm/lib/error-inject.c b/arch/arm/lib/error-inject.c
index 5a5b405792ba..1f7a482555ea 100644
--- a/arch/arm/lib/error-inject.c
+++ b/arch/arm/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->ARM_lr);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->ARM_lr;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/arm64/lib/error-inject.c b/arch/arm64/lib/error-inject.c
index ed15021da3ed..ccd33c92bb37 100644
--- a/arch/arm64/lib/error-inject.c
+++ b/arch/arm64/lib/error-inject.c
@@ -16,3 +16,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, procedure_link_pointer(regs));
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return procedure_link_pointer(regs);
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/csky/lib/error-inject.c b/arch/csky/lib/error-inject.c
index c15fb36fe067..c7a1b3948c76 100644
--- a/arch/csky/lib/error-inject.c
+++ b/arch/csky/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->lr);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->lr;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/loongarch/lib/error-inject.c b/arch/loongarch/lib/error-inject.c
index afc9e1c7c973..844356fef828 100644
--- a/arch/loongarch/lib/error-inject.c
+++ b/arch/loongarch/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->regs[1]);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->regs[1];
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/powerpc/lib/error-inject.c b/arch/powerpc/lib/error-inject.c
index e834079d2b5c..c72abce5d19f 100644
--- a/arch/powerpc/lib/error-inject.c
+++ b/arch/powerpc/lib/error-inject.c
@@ -14,3 +14,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs_set_return_ip(regs, regs->link);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->link;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/riscv/lib/error-inject.c b/arch/riscv/lib/error-inject.c
index d667ade2bc41..ed8b17acc379 100644
--- a/arch/riscv/lib/error-inject.c
+++ b/arch/riscv/lib/error-inject.c
@@ -8,3 +8,9 @@ void override_function_with_return(struct pt_regs *regs)
 	instruction_pointer_set(regs, regs->ra);
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->ra;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/s390/lib/error-inject.c b/arch/s390/lib/error-inject.c
index 8c9d4da87eef..15b23076ebeb 100644
--- a/arch/s390/lib/error-inject.c
+++ b/arch/s390/lib/error-inject.c
@@ -12,3 +12,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs->psw.addr = regs->gprs[14];
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return regs->gprs[14];
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/arch/x86/lib/error-inject.c b/arch/x86/lib/error-inject.c
index 512a2538596f..85cc46e2dd7c 100644
--- a/arch/x86/lib/error-inject.c
+++ b/arch/x86/lib/error-inject.c
@@ -23,3 +23,9 @@ void override_function_with_return(struct pt_regs *regs)
 	regs->ip = (unsigned long)&just_return_func;
 }
 NOKPROBE_SYMBOL(override_function_with_return);
+
+unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return *(unsigned long *)regs->sp;
+}
+NOKPROBE_SYMBOL(fei_return_address);
diff --git a/include/asm-generic/error-injection.h b/include/asm-generic/error-injection.h
index 6c399121ab7a..8f526d76cdcb 100644
--- a/include/asm-generic/error-injection.h
+++ b/include/asm-generic/error-injection.h
@@ -34,10 +34,15 @@ static struct error_injection_entry __used				\
 	}
 
 void override_function_with_return(struct pt_regs *regs);
+unsigned long fei_return_address(struct pt_regs *regs);
 #else
 #define ALLOW_ERROR_INJECTION(fname, _etype)
 
 static inline void override_function_with_return(struct pt_regs *regs) { }
+static inline unsigned long fei_return_address(struct pt_regs *regs)
+{
+	return 0UL;
+}
 #endif
 #endif
 
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 90cdad0412cd..a336fc565dc9 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -27,6 +27,9 @@ struct fei_attr {
 	struct list_head list;
 	struct kprobe kp;
 	unsigned long retval;
+	char	parent[KSYM_NAME_LEN];
+	unsigned long	parent_start;
+	unsigned long	parent_end;
 };
 static DEFINE_MUTEX(fei_lock);
 static LIST_HEAD(fei_attr_list);
@@ -154,13 +157,94 @@ static int fei_retval_get(void *data, u64 *val)
 DEFINE_DEBUGFS_ATTRIBUTE(fei_retval_ops, fei_retval_get, fei_retval_set,
 			 "%llx\n");
 
+static ssize_t fei_parent_read(struct file *file, char __user *buf,
+				 size_t count, loff_t *ppos)
+{
+	struct fei_attr *attr = file->private_data;
+	char tmp[KSYM_NAME_LEN + 1];
+	int len;
+	int err = 0;
+
+	mutex_lock(&fei_lock);
+	if (!fei_attr_is_valid(attr)) {
+		err = -ENOENT;
+		goto out;
+	}
+	len = scnprintf(tmp, sizeof(tmp), "%s\n", attr->parent);
+	mutex_unlock(&fei_lock);
+
+	return simple_read_from_buffer(buf, count, ppos, tmp, len);
+out:
+	mutex_unlock(&fei_lock);
+	return err;
+}
+
+static ssize_t fei_parent_write(struct file *file, const char __user *buf,
+				 size_t count, loff_t *ppos)
+{
+	struct fei_attr *attr = file->private_data;
+	char tmp[KSYM_NAME_LEN];
+	unsigned long start, size;
+	ssize_t err = 0;
+
+	if (count == 0 || count >= sizeof(tmp))
+		return -EINVAL;
+
+	if (copy_from_user(tmp, buf, count))
+		return -EFAULT;
+
+	tmp[count] = '\0';
+	strim(tmp);
+
+	mutex_lock(&fei_lock);
+	if (!fei_attr_is_valid(attr)) {
+		err = -ENOENT;
+		goto out;
+	}
+
+	if (tmp[0] == '\0') {
+		attr->parent[0]  = '\0';
+		attr->parent_start = 0;
+		attr->parent_end   = 0;
+		err = count;
+		goto out;
+	}
+
+	start = kallsyms_lookup_name(tmp);
+	if (!start) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (!kallsyms_lookup_size_offset(start, &size, NULL)) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	strscpy(attr->parent, tmp, sizeof(attr->parent));
+	attr->parent_start = start;
+	attr->parent_end   = start + size;
+	err = count;
+
+out:
+	mutex_unlock(&fei_lock);
+	return err;
+}
+
+static const struct file_operations fei_parent_ops = {
+	.owner = THIS_MODULE,
+	.open  = simple_open,
+	.read  = fei_parent_read,
+	.write = fei_parent_write,
+};
+
 static void fei_debugfs_add_attr(struct fei_attr *attr)
 {
 	struct dentry *dir;
 
 	dir = debugfs_create_dir(attr->kp.symbol_name, fei_debugfs_dir);
-
 	debugfs_create_file("retval", 0600, dir, attr, &fei_retval_ops);
+	debugfs_create_file("parent", 0600, dir, attr, &fei_parent_ops);
 }
 
 static void fei_debugfs_remove_attr(struct fei_attr *attr)
@@ -171,6 +255,16 @@ static void fei_debugfs_remove_attr(struct fei_attr *attr)
 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs)
 {
 	struct fei_attr *attr = container_of(kp, struct fei_attr, kp);
+	unsigned long ret_addr = 0;
+	bool in_parent = false;
+
+	ret_addr = fei_return_address(regs);
+	if (attr->parent_start) {
+		in_parent = (ret_addr >= attr->parent_start &&
+					ret_addr <  attr->parent_end);
+		if (!in_parent)
+			return 0;
+	}
 
 	if (should_fail(&fei_fault_attr, 1)) {
 		regs_set_return_value(regs, attr->retval);
-- 
2.43.0

Re: [RFC PATCH v2 3/3] error-injection: Introduce parent in fei_attr

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] The return value of `strim()` is ignored, which means leading spaces in the user input are not stripped, causing symbol lookup to fail.
- [Medium] Data race and torn reads when updating and reading the `parent_start` and `parent_end` bounds can lead to artificially expanded fault injection windows.
- [Medium] Parent filter caches absolute module addresses without tracking module unload, causing incorrect fault injection on newly loaded modules (ABA problem).
--

--- Patch [3]: [RFC PATCH v2 3/3] error-injection: Introduce parent in fei_attr ---
commit 0dc702571b0f5ae530c81bdc489a7fcda8f94935
Author: Song Chen <chensong_2000@126.com>

error-injection: Introduce parent in fei_attr

This patch adds a parent field to fei_attr to allow fault injection on a
function only when called from a specific parent function. It introduces
fei_return_address() across architectures to retrieve the return address
and adds a parent debugfs file to configure the filter.

[ ... ]

> diff --git a/kernel/fail_function.c b/kernel/fail_function.c
> index 90cdad0412cdd..a336fc565dc9e 100644
> --- a/kernel/fail_function.c
> +++ b/kernel/fail_function.c

[ ... ]

> +static ssize_t fei_parent_write(struct file *file, const char __user *buf,
> +				 size_t count, loff_t *ppos)
> +{

[ ... ]

> +	if (copy_from_user(tmp, buf, count))
> +		return -EFAULT;
> +
> +	tmp[count] = '\0';
> +	strim(tmp);

[Severity: Medium]
Does this correctly handle leading spaces in the user input? strim()
modifies trailing spaces in place but handles leading spaces by returning
a pointer to the first non-space character. Since the return value is
discarded here, passing a string with leading spaces to
kallsyms_lookup_name() might fail unexpectedly.

> +
> +	mutex_lock(&fei_lock);
> +	if (!fei_attr_is_valid(attr)) {

[ ... ]

> +	if (!kallsyms_lookup_size_offset(start, &size, NULL)) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> +
> +	strscpy(attr->parent, tmp, sizeof(attr->parent));
> +	attr->parent_start = start;
> +	attr->parent_end   = start + size;

[Severity: Medium]
Could this sequential update cause a data race? Since fei_kprobe_handler()
reads these fields concurrently without locks, could it observe a torn
state where the new parent_start is lower than the old parent_end,
resulting in an artificially expanded fault injection window?

[Severity: Medium]
If the resolved parent function belongs to a kernel module, could the
cached absolute addresses become stale if the module is unloaded? If a
new module is later loaded at the same address, it might falsely match
the stale parent bounds and trigger unintended fault injections.

> +	err = count;
> +
> +out:
> +	mutex_unlock(&fei_lock);
> +	return err;
> +}

[ ... ]

> @@ -171,6 +255,16 @@ static void fei_debugfs_remove_attr(struct fei_attr *attr)
>  static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs)
>  {
>  	struct fei_attr *attr = container_of(kp, struct fei_attr, kp);
> +	unsigned long ret_addr = 0;
> +	bool in_parent = false;
> +
> +	ret_addr = fei_return_address(regs);
> +	if (attr->parent_start) {
> +		in_parent = (ret_addr >= attr->parent_start &&
> +					ret_addr <  attr->parent_end);

[Severity: Medium]
Is it safe to read parent_start and parent_end here without READ_ONCE() or
synchronization, given they can be updated concurrently by
fei_parent_write()?

> +		if (!in_parent)
> +			return 0;
> +	}
>  
>  	if (should_fail(&fei_fault_attr, 1)) {
>  		regs_set_return_value(regs, attr->retval);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724021229.47302-1-chensong_2000@126.com?part=3