[PATCH bpf] bpf: reject ERR_PTR map->record in map_check_btf

[Sun Jian <sun.jian.kdev@gmail.com>]

btf_parse_fields() returns an ERR_PTR() when it encounters an invalid
special field in map value BTF.

For example, an invalid kptr-annotated field whose tagged pointee is not
a full struct type can make btf_parse_fields() fail with -EINVAL.

map_check_btf() stores the result in map->record, but currently only
handles the successful non-NULL case explicitly. ERR_PTR() results are
not rejected immediately before proceeding with the rest of map BTF
setup.

Handle IS_ERR(map->record) explicitly in map_check_btf() and return the
underlying error code immediately.

Fixes: aa3496accc412 ("bpf: Refactor kptr_off_tab into btf_record")
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 kernel/bpf/syscall.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index b73b25c63073..83e206a0626a 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1262,7 +1262,12 @@ static int map_check_btf(struct bpf_map *map, struct bpf_token *token,
 				       BPF_RB_ROOT | BPF_REFCOUNT | BPF_WORKQUEUE | BPF_UPTR |
 				       BPF_TASK_WORK,
 				       map->value_size);
-	if (!IS_ERR_OR_NULL(map->record)) {
+	if (IS_ERR(map->record)) {
+		ret = PTR_ERR(map->record);
+		map->record = NULL;
+		goto free_map_tab;
+	}
+	if (map->record) {
 		int i;
 
 		if (!bpf_token_capable(token, CAP_BPF)) {

base-commit: 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2
-- 
2.43.0