BPF plugs three NULL derefs in BTF type show paths
Key-less hash map dumps and bpf_snprintf_btf() on void or var types could oops the kernel; Jiayuan Chen restores rejections and safe placeholders.
Three NULL pointer dereferences in the kernel's BPF Type Format (BTF) show path are fixed in a series from Jiayuan Chen, closing crashes reachable when dumping maps through bpffs or when a BPF program asks bpf_snprintf_btf() to render certain types from vmlinux BTF.
One hole was opened after hash and resizable hash maps gained a BTF check callback to register destructors. That callback ignored the key, so a key-less BTF (type id 0, the void type) that used to be rejected could now be created. Reading the map back through bpffs fed that id into the show path and dereferenced a NULL show op. Syzbot reported the crash. The fix rejects key-less BTF for those map types again.
The other two predate that change and sit in bpf_snprintf_btf(), which takes a type id straight from the program. A modifier that resolves to void (for example "const void") had no show operation and crashed; a BTF_KIND_VAR against base vmlinux BTF hit a missing resolved-ids table. The series falls back to the existing unsupported-kind placeholder for void and resolves the var type without assuming resolved ids.
Selftests cover all three cases. On an unfixed kernel they deliberately walk the faulting paths and can oops the task.