[PATCH bpf] bpf: reject ERR_PTR map->record in map_check_btf

[PATCH bpf] bpf: reject ERR_PTR map->record in map_check_btf

[Sun Jian]

btf_parse_fields() returns an ERR_PTR() when it encounters an invalid
special field in map value BTF.

For example, an invalid kptr-annotated field whose tagged pointee is not
a full struct type can make btf_parse_fields() fail with -EINVAL.

map_check_btf() stores the result in map->record, but currently only
handles the successful non-NULL case explicitly. ERR_PTR() results are
not rejected immediately before proceeding with the rest of map BTF
setup.

Handle IS_ERR(map->record) explicitly in map_check_btf() and return the
underlying error code immediately.

Fixes: aa3496accc412 ("bpf: Refactor kptr_off_tab into btf_record")
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 kernel/bpf/syscall.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index b73b25c63073..83e206a0626a 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1262,7 +1262,12 @@ static int map_check_btf(struct bpf_map *map, struct bpf_token *token,
 				       BPF_RB_ROOT | BPF_REFCOUNT | BPF_WORKQUEUE | BPF_UPTR |
 				       BPF_TASK_WORK,
 				       map->value_size);
-	if (!IS_ERR_OR_NULL(map->record)) {
+	if (IS_ERR(map->record)) {
+		ret = PTR_ERR(map->record);
+		map->record = NULL;
+		goto free_map_tab;
+	}
+	if (map->record) {
 		int i;
 
 		if (!bpf_token_capable(token, CAP_BPF)) {

base-commit: 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2
-- 
2.43.0

Re: [PATCH bpf] bpf: reject ERR_PTR map->record in map_check_btf

[Alexei Starovoitov]

On Thu Apr 16, 2026 at 7:48 AM PDT, Sun Jian wrote:
> btf_parse_fields() returns an ERR_PTR() when it encounters an invalid
> special field in map value BTF.
>
> For example, an invalid kptr-annotated field whose tagged pointee is not
> a full struct type can make btf_parse_fields() fail with -EINVAL.
>
> map_check_btf() stores the result in map->record, but currently only
> handles the successful non-NULL case explicitly. ERR_PTR() results are
> not rejected immediately before proceeding with the rest of map BTF
> setup.

yes. So ?

> Handle IS_ERR(map->record) explicitly in map_check_btf() and return the
> underlying error code immediately.

why ?

pw-bot: cr

Re: [PATCH bpf] bpf: reject ERR_PTR map->record in map_check_btf

[sun jian]

On Thu, Apr 16, 2026 at 11:42 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Thu Apr 16, 2026 at 7:48 AM PDT, Sun Jian wrote:
> > btf_parse_fields() returns an ERR_PTR() when it encounters an invalid
> > special field in map value BTF.
> >
> > For example, an invalid kptr-annotated field whose tagged pointee is not
> > a full struct type can make btf_parse_fields() fail with -EINVAL.
> >
> > map_check_btf() stores the result in map->record, but currently only
> > handles the successful non-NULL case explicitly. ERR_PTR() results are
> > not rejected immediately before proceeding with the rest of map BTF
> > setup.
>
> yes. So ?
>
> > Handle IS_ERR(map->record) explicitly in map_check_btf() and return the
> > underlying error code immediately.
>
> why ?
>
> pw-bot: cr

Thanks for the feedback.

What I can show is only that an invalid map value BTF record is carried
past map_check_btf() on the old code, instead of being rejected there.

I couldn't demonstrate a stronger observable bad outcome beyond that, so I'll
drop this patch.