Re: [PATCH] bpf: btf: reject division by zero in btf_struct_walk for zero-size flex array elements

bot+bpf-ci
2026-04-13T09:26:48Z

[-- Attachment #1: Type: text/plain, Size: 1756 bytes --]

> Fixes: 1dc92851849c ("bpf: kernel side support for BTF Var and DataSec")

Should the Fixes: tag reference a different commit? Commit 1dc92851849c
adds BTF Var and DataSec support but does not modify btf_struct_walk()
and does not introduce the modulo operation that causes this bug.

The vulnerable line:

off = (off - moff) % t->size;

was introduced in 9c5f8a1008a1 ("bpf: Support variable length array in
tracing programs"), which added the flex array handling path to
btf_struct_walk(). The Fixes: tag pointing to the wrong commit could
result in incomplete stable backports.

Suggested:

Fixes: 9c5f8a1008a1 ("bpf: Support variable length array in tracing programs")

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index a62d78581207..2365d9b1ef27 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -7152,6 +7152,13 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
> if (!btf_type_is_struct(t))
> goto error;
>
> + /* Zero-size element type (e.g., empty struct) would cause
> + * division by zero below. Reject the access.
> + */

This isn't a bug, but the BPF subsystem uses the style where the
opening /* is on its own line for multi-line comments:

/*
* Zero-size element type (e.g., empty struct) would cause
* division by zero below. Reject the access.
*/

> + if (t->size == 0) {
> + bpf_log(log, "zero-size type in flex array\n");
> + goto error;
> + }
> off = (off - moff) % t->size;
> goto again;

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24334874776