btf_parse_fields() returns an ERR_PTR() when it encounters an invalid special field in map value BTF. For example, an invalid kptr-annotated field whose tagged pointee is not a full struct type can make btf_parse_fields() fail with -EINVAL. map_check_btf() stores the result in map->record, but currently only handles the successful non-NULL case explicitly. ERR_PTR() results are not rejected immediately before proceeding with the rest of map BTF setup. Handle IS_ERR(map->record) explicitly in map_check_btf() and return the underlying error code immediately. Fixes: aa3496accc412 ("bpf: Refactor kptr_off_tab into btf_record") Signed-off-by: Sun Jian --- kernel/bpf/syscall.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index b73b25c63073..83e206a0626a 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1262,7 +1262,12 @@ static int map_check_btf(struct bpf_map *map, struct bpf_token *token, BPF_RB_ROOT | BPF_REFCOUNT | BPF_WORKQUEUE | BPF_UPTR | BPF_TASK_WORK, map->value_size); - if (!IS_ERR_OR_NULL(map->record)) { + if (IS_ERR(map->record)) { + ret = PTR_ERR(map->record); + map->record = NULL; + goto free_map_tab; + } + if (map->record) { int i; if (!bpf_token_capable(token, CAP_BPF)) { base-commit: 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2 -- 2.43.0