From: Weixie Cui <cuiweixie@gmail.com>

kvmemdup_bpfptr() returns -EFAULT when the user pointer cannot be
copied, and -ENOMEM on allocation failure. The error path always
returned -ENOMEM, misreporting bad addresses as out-of-memory.

Return PTR_ERR(sig) so user space gets the correct errno.

Signed-off-by: Weixie Cui <cuiweixie@gmail.com>
---
 kernel/bpf/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 274039e36465..51ade3cde8bb 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2832,7 +2832,7 @@ static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr
 	sig = kvmemdup_bpfptr(usig, attr->signature_size);
 	if (IS_ERR(sig)) {
 		bpf_key_put(key);
-		return -ENOMEM;
+		return PTR_ERR(sig);
 	}
 
 	bpf_dynptr_init(&sig_ptr, sig, BPF_DYNPTR_TYPE_LOCAL, 0,
-- 
2.39.5 (Apple Git-154)

On Sat, Mar 21, 2026 at 02:08:00PM +0800, Weixie Cui wrote:
> From: Weixie Cui <cuiweixie@gmail.com>
> 
> kvmemdup_bpfptr() returns -EFAULT when the user pointer cannot be
> copied, and -ENOMEM on allocation failure. The error path always
> returned -ENOMEM, misreporting bad addresses as out-of-memory.
> 
> Return PTR_ERR(sig) so user space gets the correct errno.
> 
> Signed-off-by: Weixie Cui <cuiweixie@gmail.com>

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka

> ---
>  kernel/bpf/syscall.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 274039e36465..51ade3cde8bb 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -2832,7 +2832,7 @@ static int bpf_prog_verify_signature(struct bpf_prog *prog, union bpf_attr *attr
>  	sig = kvmemdup_bpfptr(usig, attr->signature_size);
>  	if (IS_ERR(sig)) {
>  		bpf_key_put(key);
> -		return -ENOMEM;
> +		return PTR_ERR(sig);
>  	}
>  
>  	bpf_dynptr_init(&sig_ptr, sig, BPF_DYNPTR_TYPE_LOCAL, 0,
> -- 
> 2.39.5 (Apple Git-154)
> 
>