bpf: fix do_misc_fixups() for bpf_get_branch_snapshot()

anakryiko · Alexei Starovoitov · commit 9806f283140e · 2024-10-23T22:16:45.000-07:00
We need `goto next_insn;` at the end of patching instead of `continue;`. It currently works by accident by making verifier re-process patched instructions. Reported-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Fixes: 314a536 ("bpf: inline bpf_get_branch_snapshot() helper") Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Link: https://lore.kernel.org/r/20241023161916.2896274-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
@@ -21210,7 +21210,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
 			delta    += cnt - 1;
 			env->prog = prog = new_prog;
 			insn      = new_prog->insnsi + i + delta;
-			continue;
+			goto next_insn;
 		}
 
 		/* Implement bpf_kptr_xchg inline */

Original file line number	Diff line number	Diff line change
`@@ -21210,7 +21210,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)`
`21210`	`21210`	`delta += cnt - 1;`
`21211`	`21211`	`env->prog = prog = new_prog;`
`21212`	`21212`	`insn = new_prog->insnsi + i + delta;`
`21213`		`- continue;`
	`21213`	`+ goto next_insn;`
`21214`	`21214`	`}`
`21215`	`21215`
`21216`	`21216`	`/* Implement bpf_kptr_xchg inline */`