btf : Fix union/anonymous struct resolution

[tdaudi]

Fixes #4974

Description

Since the resolve algorithm was implemented, Union and anonymous struct types were incorrectly resolved. The reason for this is that the final element found offset were written on top on the union/anonymous struct.

With this fix, the offset of the union/anonymous struct is incremented only when the final element matches.

No test were added because one already exist for union/anonymous struct. Therefore I just updated the logic of the test because this one was also broken.

Example

With the following policy

kprobes:
  - call: "security_key_alloc"
    syscall: false
    args:
    - index: 0
      type: "string"
      resolve: "type.name"

Before

The event look like this

"function_name": "security_key_alloc",
    "args": [
      {
        "error_arg": {
          "Message": "2"
        }
      }
    ],

After

"function_name": "security_key_alloc",
    "args": [
      {
        "string_arg": "rxrpc"
      }
    ],

[andrewstrohman]

I tested this change with:

#include <stdio.h>
#include <stdint.h>

struct yetanotherstruct {
        char *first;
        int second;
};

struct anotherstruct {
        int someint;
        struct {
                char achar;
        };
        struct {
                uint32_t someuint;
                struct {
                        char * charp;
                        struct {
                                int first;
                                struct yetanotherstruct second;
                        };
                };
        };
};


struct mystruct {
        int someint;
        struct {
                struct {
                        int anotherint;
                        struct anotherstruct another;
                };
        };
};



void passit(struct mystruct *s) {
        printf("%d\n", s->another.second.second);
}


int main(int argc, char **argv) {
        struct mystruct mys;
        mys.another.second.second = 7;
        passit(&mys);
}

And policy:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "uprobe"
spec:
  uprobes:
  - path: "/home/andy/src/nested-union-test"
    BTFPath: "/home/andy/src/nested-union-test.btf"
    symbols:
    - "passit"
    args:
    - index: 0
      type: "int"
      resolve: "another.second.second"
      BTFType: "mystruct"

And the event was as expected:

{"process_uprobe":{"process":{"exec_id":"YnVpbGRlcjo5OTIzODU1MDc5MDYwNzc4OjQxNTg3NDE=","pid":4158741,"uid":1000,"cwd":"/home/andy/build/src","binary":"/home/andy/build/src/nested-union-test","flags":"execve clone","start_time":"2026-05-08T20:32:48.215629845Z","auid":1000,"parent_exec_id":"YnVpbGRlcjoyNzUzMDAwMDAwMDoxNjEz","refcnt":1,"tid":4158741,"in_init_tree":false},"parent":{"exec_id":"YnVpbGRlcjoyNzUzMDAwMDAwMDoxNjEz","pid":1613,"uid":1000,"cwd":"/home/andy/build/src","binary":"/usr/bin/bash","flags":"procFS","start_time":"2026-01-13T23:55:40.666568747Z","auid":1000,"parent_exec_id":"YnVpbGRlcjoyNzQ2MDAwMDAwMDoxNTU4","tid":1613,"in_init_tree":false},"path":"/home/andy/src/nested-union-test","symbol":"passit","policy_name":"uprobe","args":[{"int_arg":7}],"action":"KPROBE_ACTION_POST"},"node_name":"builder","time":"2026-05-08T20:32:48.215891402Z"}

I also tested another variant of that program, where pointers are used, and that works too:

#include <stdio.h>
#include <stdint.h>

struct yetanotherstruct {
        char *first;
        int second;
};

struct anotherstruct {
        int someint;
        struct {
                char achar;
        };
        struct {
                uint32_t someuint;
                struct {
                        char * charp;
                        struct {
                                int first;
                                struct yetanotherstruct *second;
                        };
                };
        };
};


struct mystruct {
        int someint;
        struct {
                struct {
                        int anotherint;
                        struct anotherstruct *another;
                };
        };
};



void passit(struct mystruct *s) {
        printf("%d\n", s->another->second->second);
}


int main(int argc, char **argv) {
        struct mystruct mys;
        struct anotherstruct mya;
        struct yetanotherstruct myy;

        mys.another = &mya;

        mya.second = &myy;

        myy.second = 7;
        passit(&mys);
}

[kkourt]

Added a needs-backport label for both 1.7 and 1.6. I am not sure how easy the backport is for 1.6 though.

[kkourt]

I tested this change with:
[...]

Thanks, @andrewstrohman!

Do you think we can add these tests in our go tests?

[kkourt]

Added a needs-backport label for both 1.7 and 1.6. I am not sure how easy the backport is for 1.6 though.

At least for 1.7, I had to backport #4900 as well.

[andrewstrohman]

Do you think we can add these tests in our go tests?

Here is the PR to do it.