fix

Author: tecki

kernel/bpf/verifier.c

@@ -11008,6 +11008,10 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
 	bool in_callback_fn;
 	int err;
 
+	err = bpf_update_live_stack(env);
+	if (err)
+		return err;
+
 	callee = state->frame[state->curframe];
 	r0 = &callee->regs[BPF_REG_0];
 	if (r0->type == PTR_TO_STACK) {
@@ -11404,8 +11408,7 @@ static inline bool in_sleepable_context(struct bpf_verifier_env *env)
 
 static int check_helper_call(struct bpf_verifier_env *env,
 			     struct bpf_insn *insn,
-			     int *insn_idx_p,
-			     bool *do_print_state)
+			     int *insn_idx_p)
 {
 	enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
 	bool returns_cpu_specific_alloc_ptr = false;
@@ -11917,18 +11920,21 @@ static int check_helper_call(struct bpf_verifier_env *env,
 	}
 
 	if (func_id == BPF_FUNC_tail_call) {
-		struct bpf_verifier_state *branch;
-		mark_reg_scratched(env, BPF_REG_0);
-		branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
-		if (IS_ERR(branch))
-			return PTR_ERR(branch);
-		clear_all_pkt_pointers(env);
-		mark_reg_unknown(env, regs, BPF_REG_0);
-		err = process_bpf_exit_full(env, do_print_state, false);
-		if (err)
-			return err;
-		else
+		if (env->cur_state->curframe) {
+			struct bpf_verifier_state *branch;
+			mark_reg_scratched(env, BPF_REG_0);
+			branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+			if (IS_ERR(branch))
+				return PTR_ERR(branch);
+			clear_all_pkt_pointers(env);
+			mark_reg_unknown(env, regs, BPF_REG_0);
+			err = prepare_func_exit(env, &env->insn_idx);
+			if (err)
+				return err;
 			env->insn_idx--;
+		} else {
+			changes_data = false;
+		}
 	}
 
 	if (changes_data)
@@ -19865,9 +19871,6 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env,
 		return PROCESS_BPF_EXIT;
 
 	if (env->cur_state->curframe) {
-		err = bpf_update_live_stack(env);
-		if (err)
-			return err;
 		/* exit from nested function */
 		err = prepare_func_exit(env, &env->insn_idx);
 		if (err)
@@ -19977,7 +19980,7 @@ static int do_check_insn(struct bpf_verifier_env *env, bool *do_print_state)
 				if (!err && is_bpf_throw_kfunc(insn))
 					return process_bpf_exit_full(env, do_print_state, true);
 			} else {
-				err = check_helper_call(env, insn, &env->insn_idx, do_print_state);
+				err = check_helper_call(env, insn, &env->insn_idx);
 			}
 			if (err)
 				return err;