libbpf: Validate ELF symbol table entry size

[PATCH bpf-next] libbpf: Validate ELF symbol table entry size

Posted by Luis Vieira 1 week, 1 day ago

elf_sym_iter_new() calculates the number of symbols by dividing the
symbol table data size by sh_entsize. A malformed ELF file with a zero
sh_entsize causes a division by zero.

Reject symbol table sections with a zero entry size before calculating
the number of symbols.

Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
---
 tools/lib/bpf/elf.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/lib/bpf/elf.c b/tools/lib/bpf/elf.c
index fe136d025967..ba0b3df37a59 100644
--- a/tools/lib/bpf/elf.c
+++ b/tools/lib/bpf/elf.c
@@ -118,6 +118,11 @@ static int elf_sym_iter_new(struct elf_sym_iter *iter,
 	if (!gelf_getshdr(scn, &sh))
 		return -EINVAL;
 
+	if (!sh.sh_entsize) {
+		pr_warn("elf: symbol table section has zero entry size in '%s'\n", binary_path);
+		return -EINVAL;
+	}
+
 	iter->strtabidx = sh.sh_link;
 	iter->syms = elf_getdata(scn, 0);
 	if (!iter->syms) {

---
base-commit: 10c4f610b215bf961235141161992f010cf7e451
change-id: 20260916-libbpf-elf-entsize-fix-a0f9440e79c7

Best regards,
--  
Luis Vieira <luisflavieira@gmail.com>

Re: [PATCH bpf-next] libbpf: Validate ELF symbol table entry size

Posted by Andrii Nakryiko 3 days, 6 hours ago

On Wed, Sep 16, 2026 at 2:23 PM Luis Vieira <luisflavieira@gmail.com> wrote:
>
> elf_sym_iter_new() calculates the number of symbols by dividing the
> symbol table data size by sh_entsize. A malformed ELF file with a zero
> sh_entsize causes a division by zero.
>
> Reject symbol table sections with a zero entry size before calculating
> the number of symbols.
>
> Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
> ---
>  tools/lib/bpf/elf.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/tools/lib/bpf/elf.c b/tools/lib/bpf/elf.c
> index fe136d025967..ba0b3df37a59 100644
> --- a/tools/lib/bpf/elf.c
> +++ b/tools/lib/bpf/elf.c
> @@ -118,6 +118,11 @@ static int elf_sym_iter_new(struct elf_sym_iter *iter,
>         if (!gelf_getshdr(scn, &sh))
>                 return -EINVAL;
>
> +       if (!sh.sh_entsize) {
> +               pr_warn("elf: symbol table section has zero entry size in '%s'\n", binary_path);
> +               return -EINVAL;
> +       }
> +

modified as follows and applied to bpf-next

-       if (!gelf_getshdr(scn, &sh))
+       if (!gelf_getshdr(scn, &sh) || !sh.sh_entsize)
                return -EINVAL;

-       if (!sh.sh_entsize) {
-               pr_warn("elf: symbol table section has zero entry size
in '%s'\n", binary_path);
-               return -EINVAL;
-       }
-

>         iter->strtabidx = sh.sh_link;
>         iter->syms = elf_getdata(scn, 0);
>         if (!iter->syms) {
>
> ---
> base-commit: 10c4f610b215bf961235141161992f010cf7e451
> change-id: 20260916-libbpf-elf-entsize-fix-a0f9440e79c7
>
> Best regards,
> --
> Luis Vieira <luisflavieira@gmail.com>
>

Re: [PATCH bpf-next] libbpf: Validate ELF symbol table entry size

Posted by bot+bpf-ci@kernel.org 1 week, 1 day ago

>     libbpf: Validate ELF symbol table entry size
>
>     elf_sym_iter_new() calculates the number of symbols by dividing the
>     symbol table data size by sh_entsize. A malformed ELF file with a zero
>     sh_entsize causes a division by zero.
>
>     Reject symbol table sections with a zero entry size before calculating
>     the number of symbols.
>
>     Signed-off-by: Luis Vieira <luisflavieira@gmail.com>

This looks like a bug fix for the elf symbol iterator. Should this include:

  Fixes: 3774705db171 ("libbpf: Add elf symbol iterator")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35154126900