> bpf: Blind constants through the patch list

TL;DR: Nit in bpf_jit_blind_constants() error path: the comment about patching
repointing aux->prog during realloc looks stale now that the patch list
reallocs only when nothing can fail; "clone = env->prog" may be a no-op.

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 10d2c37f8128..7d58c47b73f0 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c

[ ... ]

> @@ -1990,47 +1990,52 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_verifier_env *env, struct bp

[ ... ]

> +	if (err) {
> +		if (env) {
> +			bpf_patch_list_free(env);
> +			/* restore the original prog */
> +			clone = env->prog;
> +			env->prog = prog;
> +		}
> +		bpf_patch_list_release(&pl);
> +		/* Patching may have repointed aux->prog during
> +		 * realloc from the original one, so we need to
> +		 * fix it up here on error.
> +		 */
> +		bpf_jit_prog_release_other(prog, clone);

Does this comment still describe a case that can happen?

Before this patch each bpf_patch_insn_data() or bpf_patch_insn_single() call
could bpf_prog_realloc() the clone, which does fp->aux->prog = fp, and a
later patch could still fail.  The error path therefore had to point the
shared aux->prog back at the original program.

With the patch list the clone is only reallocated at a point where nothing
can fail afterwards:

bpf_patch_list_commit():
	prog = bpf_prog_realloc(prog, bpf_prog_size(img.new_cnt), GFP_USER);
	if (!prog)
		goto out;
	env->prog = prog;
	... (only void steps follow) ...
	err = 0;

bpf_patch_list_apply():
	new = bpf_prog_realloc(prog, bpf_prog_size(img.new_cnt), GFP_USER);
	if (new) {
		prog = new;
		bpf_patch_image_install(prog, &img);
	} else {
		err = -ENOMEM;
	}

So when err is non-zero the clone was never reallocated.  aux->prog still
points at the original prog, since bpf_prog_clone_create() only memcpy()s,
and env->prog is still the clone.  That also makes the new
"clone = env->prog;" a no-op.

bpf_jit_prog_release_other() is still needed to free the clone, but "Patching
may have repointed aux->prog during realloc" can no longer happen here.

Should the comment be updated, for example to say that the patches are only
applied once nothing can fail, so the clone just needs to be freed here?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/41053659762