bpf: fix potential error return

[ Upstream commit c4441ca86afe4814039ee1b32c39d833c1a16bbc ]

The bpf_remove_insns() function returns WARN_ON_ONCE(error), where
error is a result of bpf_adj_branches(), and thus should be always 0
However, if for any reason it is not 0, then it will be converted to
boolean by WARN_ON_ONCE and returned to user space as 1, not an actual
error value. Fix this by returning the original err after the WARN check.

Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20241210114245.836164-1-aspsk@isovalent.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 33ea6ab12f47c72d5062f743cf6dca8f82078ca0..db613a97ee5f96e5a893d23ebb268a0d2be35732 100644 (file)
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -501,6 +501,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
 
 int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
 {
+       int err;
+
        /* Branch offsets can't overflow when program is shrinking, no need
         * to call bpf_adj_branches(..., true) here
         */
@@ -508,7 +510,9 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
                sizeof(struct bpf_insn) * (prog->len - off - cnt));
        prog->len -= cnt;
 
-       return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
+       err = bpf_adj_branches(prog, off, off + cnt, off, false);
+       WARN_ON_ONCE(err);
+       return err;
 }
 
 static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)