bpf: verbose jump offset overflow check

Larger programs may trigger 16-bit jump offset overflow check
during instruction patching. Make this error verbose otherwise
users cannot decipher error code without printks in the verifier.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index ff09d32a8a1be210e88a0e6f7f14596ee6b89f06..2966cb368bf40a562c7d6ed44543a09a1d47fd0c 100644 (file)
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -438,6 +438,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
        u32 insn_adj_cnt, insn_rest, insn_delta = len - 1;
        const u32 cnt_max = S16_MAX;
        struct bpf_prog *prog_adj;
+       int err;
 
        /* Since our patchlet doesn't expand the image, we're done. */
        if (insn_delta == 0) {
@@ -453,8 +454,8 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
         * we afterwards may not fail anymore.
         */
        if (insn_adj_cnt > cnt_max &&
-           bpf_adj_branches(prog, off, off + 1, off + len, true))
-               return NULL;
+           (err = bpf_adj_branches(prog, off, off + 1, off + len, true)))
+               return ERR_PTR(err);
 
        /* Several new instructions need to be inserted. Make room
         * for them. Likely, there's no need for a new allocation as
@@ -463,7 +464,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
        prog_adj = bpf_prog_realloc(prog, bpf_prog_size(insn_adj_cnt),
                                    GFP_USER);
        if (!prog_adj)
-               return NULL;
+               return ERR_PTR(-ENOMEM);
 
        prog_adj->len = insn_adj_cnt;
 
@@ -1096,13 +1097,13 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog)
                        continue;
 
                tmp = bpf_patch_insn_single(clone, i, insn_buff, rewritten);
-               if (!tmp) {
+               if (IS_ERR(tmp)) {
                        /* Patching may have repointed aux->prog during
                         * realloc from the original one, so we need to
                         * fix it up here on error.
                         */
                        bpf_jit_prog_release_other(prog, clone);
-                       return ERR_PTR(-ENOMEM);
+                       return tmp;
                }
 
                clone = tmp;

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ad3494a881dad889039f7d9ee278f6c6f863ec8c..6dcfeb44bb8ef95cf5caa56d3b37d61b7b5810b8 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6932,8 +6932,13 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
        struct bpf_prog *new_prog;
 
        new_prog = bpf_patch_insn_single(env->prog, off, patch, len);
-       if (!new_prog)
+       if (IS_ERR(new_prog)) {
+               if (PTR_ERR(new_prog) == -ERANGE)
+                       verbose(env,
+                               "insn %d cannot be patched due to 16-bit range\n",
+                               env->insn_aux_data[off].orig_idx);
                return NULL;
+       }
        if (adjust_insn_aux_data(env, new_prog->len, off, len))
                return NULL;
        adjust_subprog_starts(env, off, len);