bpf: fix potential error return

[ Upstream commit c4441ca86afe4814039ee1b32c39d833c1a16bbc ]

The bpf_remove_insns() function returns WARN_ON_ONCE(error), where
error is a result of bpf_adj_branches(), and thus should be always 0
However, if for any reason it is not 0, then it will be converted to
boolean by WARN_ON_ONCE and returned to user space as 1, not an actual
error value. Fix this by returning the original err after the WARN check.

Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20241210114245.836164-1-aspsk@isovalent.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 0ea0d50a7c161f6f9e31c6d940c7c0578923c9fa..83b416af4da18f5dd594026978fc5590efadde67 100644 (file)
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -523,6 +523,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
 
 int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
 {
+       int err;
+
        /* Branch offsets can't overflow when program is shrinking, no need
         * to call bpf_adj_branches(..., true) here
         */
@@ -530,7 +532,9 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
                sizeof(struct bpf_insn) * (prog->len - off - cnt));
        prog->len -= cnt;
 
-       return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
+       err = bpf_adj_branches(prog, off, off + cnt, off, false);
+       WARN_ON_ONCE(err);
+       return err;
 }
 
 static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)