Commit 6b84d789 authored by Luis Gerhorst's avatar Luis Gerhorst Committed by Alexei Starovoitov
Browse files

bpf: Return -EFAULT on internal errors 



This prevents us from trying to recover from these on speculative paths
in the future.

Signed-off-by: default avatarLuis Gerhorst <luis.gerhorst@fau.de>
Reviewed-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: default avatarHenriette Herzog <henriette.herzog@rub.de>
Cc: Maximilian Ott <ott@cs.fau.de>
Cc: Milan Stephan <milan.stephan@fau.de>
Link: https://lore.kernel.org/r/20250603205800.334980-4-luis.gerhorst@fau.de


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent fd508bde

kernel/bpf/verifier.c

+3 −3
Original line number Diff line number Diff line
@@ -11654,7 +11654,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn 
				verbose(env, "verifier internal error:");

				verbose(env, "func %s has non-overwritten BPF_PTR_POISON return type\n",

					func_id_name(func_id));

				return -EINVAL;

				return -EFAULT;

			}

			ret_btf = btf_vmlinux;

			ret_btf_id = *fn->ret_btf_id;
@@ -15287,12 +15287,12 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, 
	if (WARN_ON_ONCE(ptr_reg)) {

		print_verifier_state(env, vstate, vstate->curframe, true);

		verbose(env, "verifier internal error: unexpected ptr_reg\n");

		return -EINVAL;

		return -EFAULT;

	}

	if (WARN_ON(!src_reg)) {

		print_verifier_state(env, vstate, vstate->curframe, true);

		verbose(env, "verifier internal error: no src_reg\n");

		return -EINVAL;

		return -EFAULT;

	}

	err = adjust_scalar_min_max_vals(env, insn, dst_reg, *src_reg);

	if (err)