This series fixes three NULL-ptr-derefs in BTF handling. Patch 1 handles the syzbot report. A key-less BTF (btf_key_type_id == 0) used to be rejected for hash maps, until htab and rhtab gained a ->map_check_btf (to register a dtor) that does not look at the key, so a key-less hash map is now accepted. Dumping it through bpffs feeds the key type_id 0 into btf_type_seq_show() and NULL-derefs in btf_type_show(). Reject it again.
Patches 2 and 3 fix two related, pre-existing crashes reachable via bpf_snprintf_btf(), which renders a type_id taken straight from the BPF program against the vmlinux BTF. A "const void" (a modifier resolving to void) NULL-derefs in btf_modifier_show() - void has no ->show op; a BTF_KIND_VAR NULL-derefs in btf_var_show() - the vmlinux base BTF has no resolved_ids. Patch 2 falls back to btf_df_show(), the "<unsupported kind:N>" placeholder already used for FWD/FUNC/FLOAT/DECL_TAG; patch 3 resolves the var's type directly, mirroring the existing guard in btf_modifier_show(). Patches 4 and 5 add selftests for the three cases. They are meant to reproduce the crashes: each deliberately walks the faulting path, so on an unfixed kernel it oopses the task (and panics it under panic_on_oops). That is intentional - the tests verify the fix and reproduce the bug - so a static review flagging them for crashing an unfixed kernel can be ignored. v2 -> v3: Fold in a third fix for the same class of bug, btf_var_show(), reported while reviewing v2. Address review comments (Fixes attribution, verbatim syzbot trace, skip instead of fail). v1 -> v2: AI reported a pre-exist issue. Let's fold it in this series. v2: https://lore.kernel.org/bpf/[email protected]/ v1: https://lore.kernel.org/bpf/[email protected]/ Jiayuan Chen (5): bpf: Reject key-less BTF for hash maps bpf: Fix NULL-ptr-deref when showing a void BTF type bpf: Fix NULL-ptr-deref in btf_var_show() selftests/bpf: Add test for key-less BTF hash map selftests/bpf: Add test for showing a void BTF type kernel/bpf/btf.c | 20 ++++- kernel/bpf/hashtab.c | 8 ++ .../bpf/prog_tests/btf_map_keyless.c | 82 +++++++++++++++++++ .../selftests/bpf/prog_tests/btf_show_void.c | 81 ++++++++++++++++++ .../selftests/bpf/progs/btf_show_void.c | 24 ++++++ 5 files changed, 213 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_show_void.c create mode 100644 tools/testing/selftests/bpf/progs/btf_show_void.c -- 2.43.0
