Re: [PATCH bpf-next] libbpf: Validate ELF symbol table entry size

[Andrii Nakryiko]

On Wed, Sep 16, 2026 at 2:23 PM Luis Vieira <luisflavieira@xxxxxxxxx> wrote:
>
> elf_sym_iter_new() calculates the number of symbols by dividing the
> symbol table data size by sh_entsize. A malformed ELF file with a zero
> sh_entsize causes a division by zero.
>
> Reject symbol table sections with a zero entry size before calculating
> the number of symbols.
>
> Signed-off-by: Luis Vieira <luisflavieira@xxxxxxxxx>
> ---
>  tools/lib/bpf/elf.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/tools/lib/bpf/elf.c b/tools/lib/bpf/elf.c
> index fe136d025967..ba0b3df37a59 100644
> --- a/tools/lib/bpf/elf.c
> +++ b/tools/lib/bpf/elf.c
> @@ -118,6 +118,11 @@ static int elf_sym_iter_new(struct elf_sym_iter *iter,
>         if (!gelf_getshdr(scn, &sh))
>                 return -EINVAL;
>
> +       if (!sh.sh_entsize) {
> +               pr_warn("elf: symbol table section has zero entry size in '%s'\n", binary_path);
> +               return -EINVAL;
> +       }
> +

modified as follows and applied to bpf-next

-       if (!gelf_getshdr(scn, &sh))
+       if (!gelf_getshdr(scn, &sh) || !sh.sh_entsize)
                return -EINVAL;

-       if (!sh.sh_entsize) {
-               pr_warn("elf: symbol table section has zero entry size
in '%s'\n", binary_path);
-               return -EINVAL;
-       }
-

>         iter->strtabidx = sh.sh_link;
>         iter->syms = elf_getdata(scn, 0);
>         if (!iter->syms) {
>
> ---
> base-commit: 10c4f610b215bf961235141161992f010cf7e451
> change-id: 20260916-libbpf-elf-entsize-fix-a0f9440e79c7
>
> Best regards,
> --
> Luis Vieira <luisflavieira@xxxxxxxxx>
>