From: Eduard Zingerman <eddyz87@gmail.com>
To: Jiayuan Chen <jiayuan.chen@linux.dev>, bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
Shuah Khan <shuah@kernel.org>, Amery Hung <ameryhung@gmail.com>,
Tejun Heo <tj@kernel.org>,
Matt Bobrowski <mattbobrowski@google.com>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org
Subject: Re: [PATCH bpf 1/2] bpf: Fix divide-by-zero in btf_struct_walk()
Date: Thu, 10 Sep 2026 14:49:42 -0700 [thread overview]
Message-ID: <87c1060d5233c9b7a73fcaf1b6d96bc1a700c49e.camel@gmail.com> (raw)
In-Reply-To: <20260910122316.186384-1-jiayuan.chen@linux.dev>
On Thu, 2026-09-10 at 20:22 +0800, Jiayuan Chen wrote:
> When an access goes past the struct and the last member is a flexible
> array, btf_struct_walk() folds the offset back into a single element with
> (off - moff) % t->size, but never checks that the element type has a size.
>
> BTF takes an empty struct, so this in program BTF
>
> /* event could be empty */
> struct event {
> #ifdef HAVE_TIMESTAMP
> __u64 ts;
> #endif
> };
>
> struct batch {
> int nr;
> struct event events[];
> };
>
> divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
> is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
> sleepable program.
>
> Oops: divide error: 0000 [#1] SMP KASAN PTI
> RIP: 0010:btf_struct_walk+0x53f/0x1570
> Call Trace:
> <TASK>
> btf_struct_access+0x42a/0xcd0
> check_ptr_to_btf_access+0x4dc/0x1160
> check_mem_access+0x3a45/0x8740
> check_load_mem+0x36a/0xd10
> do_check_common+0x3ef0/0xb210
> bpf_check+0x6d3b/0x8580
> bpf_prog_load+0xf7c/0x2720
> __sys_bpf+0xa83/0x3690
> __x64_sys_bpf+0xc7/0x150
> x64_sys_call+0x1f3f/0x27e0
> do_syscall_64+0xe5/0x610
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> Reject a zero-sized element type. The fixed array path in the same function
> already bails out on the same thing:
>
> btf_struct_walk()
> ...
> /* skip empty array */
> if (moff == mtrue_end)
> continue;
>
> msize /= total_nelems;
>
> Fixes: 9c5f8a1008a1 ("bpf: Support variable length array in tracing programs")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
next prev parent reply other threads:[~2026-09-10 21:49 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 12:22 [PATCH bpf 1/2] bpf: Fix divide-by-zero in btf_struct_walk() Jiayuan Chen
2026-09-10 12:22 ` [PATCH bpf 2/2] selftests/bpf: Test BTF walk into a flexible array of zero-sized elements Jiayuan Chen
2026-09-10 22:01 ` Eduard Zingerman
2026-09-10 21:49 ` Eduard Zingerman [this message]
2026-09-11 0:00 ` [PATCH bpf 1/2] bpf: Fix divide-by-zero in btf_struct_walk() patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87c1060d5233c9b7a73fcaf1b6d96bc1a700c49e.camel@gmail.com \
--to=eddyz87@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jiayuan.chen@linux.dev \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mattbobrowski@google.com \
--cc=memxor@gmail.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tj@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.