Re: [PATCH] bpf: btf: reject division by zero in btf_struct_walk for zero-size flex array elements

Eduard Zingerman
2026-04-13T21:43:29Z

On Mon, 2026-04-13 at 16:50 +0800, Dudu Lu wrote:
> btf_struct_walk() computes `off = (off - moff) % t->size` when handling
> access to a flexible array member. If the element type is a zero-size
> struct (e.g., `struct B {}`), t->size is 0 and this causes a division-
> by-zero exception. On x86 this triggers a #DE fault resulting in a
> kernel panic.
>
> The BTF validator does not reject zero-size structs: btf_struct_check_meta()
> passes trivially for vlen=0 structs, and btf_array_resolve() skips the
> overflow check for flex arrays (nelems=0). This allows a user to load
> crafted BTF containing `struct B {}; struct A { int x; struct B flex[]; }`
> and then trigger the crash when the verifier calls btf_struct_walk()
> during program load.

Could you please add a selftest as well? …