bpf: Return -EFAULT on internal errors

This prevents us from trying to recover from these on speculative paths
in the future.

Signed-off-by: Luis Gerhorst <luis.gerhorst@fau.de>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Henriette Herzog <henriette.herzog@rub.de>
Cc: Maximilian Ott <ott@cs.fau.de>
Cc: Milan Stephan <milan.stephan@fau.de>
Link: https://lore.kernel.org/r/20250603205800.334980-4-luis.gerhorst@fau.de
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 464facb1e283cac407d4b0a454cc90ac8d6ba69d..04465e317f1008b64cc8268593186d66b9c3483e 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11654,7 +11654,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
                                verbose(env, "verifier internal error:");
                                verbose(env, "func %s has non-overwritten BPF_PTR_POISON return type\n",
                                        func_id_name(func_id));
-                               return -EINVAL;
+                               return -EFAULT;
                        }
                        ret_btf = btf_vmlinux;
                        ret_btf_id = *fn->ret_btf_id;
@@ -15287,12 +15287,12 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
        if (WARN_ON_ONCE(ptr_reg)) {
                print_verifier_state(env, vstate, vstate->curframe, true);
                verbose(env, "verifier internal error: unexpected ptr_reg\n");
-               return -EINVAL;
+               return -EFAULT;
        }
        if (WARN_ON(!src_reg)) {
                print_verifier_state(env, vstate, vstate->curframe, true);
                verbose(env, "verifier internal error: no src_reg\n");
-               return -EINVAL;
+               return -EFAULT;
        }
        err = adjust_scalar_min_max_vals(env, insn, dst_reg, *src_reg);
        if (err)