[PATCH bpf 1/2] bpf: Fix divide-by-zero in btf_struct_walk()

[Jiayuan Chen]

When an access goes past the struct and the last member is a flexible
array, btf_struct_walk() folds the offset back into a single element with
(off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

        /* event could be empty */
        struct event {
 #ifdef HAVE_TIMESTAMP
                __u64 ts;
 #endif
        };

        struct batch {
                int nr;
                struct event events[];
        };

divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:btf_struct_walk+0x53f/0x1570
Call Trace:
 <TASK>
 btf_struct_access+0x42a/0xcd0
 check_ptr_to_btf_access+0x4dc/0x1160
 check_mem_access+0x3a45/0x8740
 check_load_mem+0x36a/0xd10
 do_check_common+0x3ef0/0xb210
 bpf_check+0x6d3b/0x8580
 bpf_prog_load+0xf7c/0x2720
 __sys_bpf+0xa83/0x3690
 __x64_sys_bpf+0xc7/0x150
 x64_sys_call+0x1f3f/0x27e0
 do_syscall_64+0xe5/0x610
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>

Reject a zero-sized element type. The fixed array path in the same function
already bails out on the same thing:

        btf_struct_walk()
        ...
                /* skip empty array */
                if (moff == mtrue_end)
                        continue;

                msize /= total_nelems;

Fixes: 9c5f8a1008a1 ("bpf: Support variable length array in tracing programs")
Signed-off-by: Jiayuan Chen <jiayuan.c...@linux.dev>
---
 kernel/bpf/btf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 31057c8f3a7c..1c5de50b9cab 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -7203,7 +7203,7 @@ static int btf_struct_walk(struct bpf_verifier_log *log, 
const struct btf *btf,
                if (btf_type_is_int(t))
                        return WALK_SCALAR;
 
-               if (!btf_type_is_struct(t))
+               if (!btf_type_is_struct(t) || !t->size)
                        goto error;
 
                off = (off - moff) % t->size;
-- 
2.43.0