Re: [PATCH v11 bpf-next 6/8] btf: support kernel parsing of BTF with layout info

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 4872d2a6c42d..bda363a2592e 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c

[ ... ]

> +static int btf_parse_layout_sec(struct btf_verifier_env *env)
> +{
> +	const struct btf_header *hdr = &env->btf->hdr;
> +	struct btf *btf = env->btf;
> +	void *start, *end;
> +
> +	if (hdr->hdr_len < sizeof(struct btf_header) ||
> +	    hdr->layout_len == 0)
> +		return 0;
> +
> +	/* Layout section must align to 4 bytes */
> +	if (hdr->layout_off & (sizeof(u32) - 1)) {
> +		btf_verifier_log(env, "Unaligned layout_off");
> +		return -EINVAL;
> +	}
> +	start = btf->nohdr_data + hdr->layout_off;
> +	end = start + hdr->layout_len;
> +
> +	if (hdr->layout_len % sizeof(struct btf_layout) != 0) {
> +		btf_verifier_log(env, "layout_len is not multiple of %zu",
> +				 sizeof(struct btf_layout));
> +		return -EINVAL;
> +	}
> +	if (hdr->layout_len < sizeof(struct btf_layout)) {
> +		btf_verifier_log(env, "Layout section is too small");
> +		return -EINVAL;
> +	}

Is this "too small" check reachable? At this point layout_len is
non-zero (the == 0 case returned above) and is a multiple of
sizeof(struct btf_layout) which is 4.  A positive multiple of 4 is
always >= 4, so this branch can never execute.

If the modulo check above it were removed or reordered in the
future, this would become live again, but as written it appears
to be dead code.

> +	if (end > btf->data + btf->data_size) {
> +		btf_verifier_log(env, "Layout section is too big");
> +		return -EINVAL;
> +	}
> +	btf->layout = start;
> +
> +	return 0;
> +}

[ ... ]

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22574705927

AI-authorship-score: low
AI-authorship-explanation: Part of a v10 series with 3 years of mailing list discussion, demonstrates deep BTF expertise, and the dead code is a characteristically human oversight from iteratively addressing review feedback.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: Dead validation code in btf_parse_layout_sec that can never execute due to a preceding modulo check; no functional impact since the unreachable branch would only reject invalid input that is already rejected.