In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btf_struct_walk() When an access goes past

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix divide-by-zero in btf_struct_walk()

When an access goes past the struct and the last member is a flexible
array, btf_struct_walk() folds the offset back into a single element with
(off - moff) % t->size, but never checks that the element type has a size.

BTF takes an empty struct, so this in program BTF

 1/* event could be empty */
 2struct event {

#ifdef HAVE_TIMESTAMP
__u64 ts;
#endif
};

 1struct batch {
 2	int nr;
 3	struct event events[];
 4};

divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
sleepable program.

Oops: divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:btf_struct_walk+0x53f/0x1570
Call Trace:
<TASK>
btf_struct_access+0x42a/0xcd0
check_ptr_to_btf_access+0x4dc/0x1160
check_mem_access+0x3a45/0x8740
check_load_mem+0x36a/0xd10
do_check_common+0x3ef0/0xb210
bpf_check+0x6d3b/0x8580
bpf_prog_load+0xf7c/0x2720
__sys_bpf+0xa83/0x3690
__x64_sys_bpf+0xc7/0x150
x64_sys_call+0x1f3f/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Reject a zero-sized element type. The fixed array path in the same function
already bails out on the same thing:

 1btf_struct_walk()
 2...
 3	/* skip empty array */
 4	if (moff == mtrue_end)
 5		continue;
 6 
 7	msize /= total_nelems;