[PATCH 6.6.y] bpf: Ensure reg is PTR_TO_STACK in process_iter_arg

[PATCH 6.6.y] bpf: Ensure reg is PTR_TO_STACK in process_iter_arg

[Xu Yunxiang]

Currently KF_ARG_PTR_TO_ITER handling does not check reg->type.
process_iter_arg() therefore accepts any register whose constant offset
resolves to the stack slot of an initialized iterator — a bare SCALAR
(kernel panic) as well as pointers to real kernel objects (map value,
ctx).

This is the 6.6.y equivalent of 12659d28615d ("bpf: Ensure reg is
PTR_TO_STACK in process_iter_arg"), which is in mainline since 6.13-rc
and was backported to 6.12.5. The original commit was framed as
completeness (align with process_dynptr_func) and was never queued for
6.6.y. 6.6 still lacks the type check (verified through 6.6.154).

The verbose argument index uses `regno` to match the surrounding 6.6
messages in this function (later trees print regno - 1).
The verifier_bits_iter.c hunk from 12659d28615d is omitted: that file
does not exist in 6.6.

commit 12659d28615d upstream
Fixes: 06accc8779c1 ("bpf: add support for open-coded iterator loops")
Cc: stable@vger.kernel.org # 6.6.y

Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
---
 kernel/bpf/verifier.c | 5 ++++++
 1 file changed

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7827,6 +7827,11 @@
 	int spi, err, i, nr_slots;
 	u32 btf_id;
 
+	if (reg->type != PTR_TO_STACK) {
+		verbose(env, "arg#%d expected pointer to an iterator on stack\n", regno);
+		return -EINVAL;
+	}
+
 	/* btf_check_iter_kfuncs() ensures we don't need to validate anything here */
 	arg = &btf_params(meta->func_proto)[0];
 	t = btf_type_skip_modifiers(meta->btf, arg->type, NULL);	/* PTR */
-- 
BPF-SemSan disclosure follow-up

Re: [PATCH 6.6.y] bpf: Ensure reg is PTR_TO_STACK in process_iter_arg

[Greg Kroah-Hartman]

On Fri, Aug 28, 2026 at 12:45:59PM +0800, Xu Yunxiang wrote:
> Currently KF_ARG_PTR_TO_ITER handling does not check reg->type.
> process_iter_arg() therefore accepts any register whose constant offset
> resolves to the stack slot of an initialized iterator — a bare SCALAR
> (kernel panic) as well as pointers to real kernel objects (map value,
> ctx).
> 
> This is the 6.6.y equivalent of 12659d28615d ("bpf: Ensure reg is
> PTR_TO_STACK in process_iter_arg"), which is in mainline since 6.13-rc
> and was backported to 6.12.5. The original commit was framed as
> completeness (align with process_dynptr_func) and was never queued for
> 6.6.y. 6.6 still lacks the type check (verified through 6.6.154).
> 
> The verbose argument index uses `regno` to match the surrounding 6.6
> messages in this function (later trees print regno - 1).
> The verifier_bits_iter.c hunk from 12659d28615d is omitted: that file
> does not exist in 6.6.
> 
> commit 12659d28615d upstream
> Fixes: 06accc8779c1 ("bpf: add support for open-coded iterator loops")
> Cc: stable@vger.kernel.org # 6.6.y
> 
> Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>

You lost all of the original authorship and signed-off-by lines, AND you
changed this from the original in a way and did not document that.

Please fix that up and resend.  See the thousands of examples on the
stable@vger.kernel.org list for examples of how to do this.

thanks,

greg k-h

[PATCH 6.6.y v2] bpf: Ensure reg is PTR_TO_STACK in process_iter_arg

[Xu Yunxiang]

From: Tao Lyu <tao.lyu@epfl.ch>

commit 12659d28615d606b36e382f4de2dd05550d202af upstream.

Currently, KF_ARG_PTR_TO_ITER handling missed checking the reg->type and
ensuring it is PTR_TO_STACK. Instead of enforcing this in the caller of
process_iter_arg, move the check into it instead so that all callers
will gain the check by default. This is similar to process_dynptr_func.

An existing selftest in verifier_bits_iter.c fails due to this change,
but it's because it was passing a NULL pointer into iter_next helper and
getting an error further down the checks, but probably meant to pass an
uninitialized iterator on the stack (as is done in the subsequent test
below it). We will gain coverage for non-PTR_TO_STACK arguments in later
patches hence just change the declaration to zero-ed stack object.

Fixes: 06accc8779c1 ("bpf: add support for open-coded iterator loops")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Tao Lyu <tao.lyu@epfl.ch>
[ Kartikeya: move check into process_iter_arg, rewrite commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241203000238.3602922-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

[ Xu Yunxiang: Resolve the verifier.c context conflict by retaining the
  6.6.y BTF lookup and its regno diagnostic convention. Omit the
  verifier_bits_iter.c change because that selftest does not exist in
  6.6.y. ]
Assisted-by: Pi:GLM-5.3

Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
---
Changes in v2:
- restore the upstream author and complete Signed-off-by/trailer chain;
- document the 6.6.y context adjustment and why the upstream selftest
  hunk is omitted.

 kernel/bpf/verifier.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ad679bc42427c8..fc97a5fff9b7d7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7827,6 +7827,11 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
 	int spi, err, i, nr_slots;
 	u32 btf_id;
 
+	if (reg->type != PTR_TO_STACK) {
+		verbose(env, "arg#%d expected pointer to an iterator on stack\n", regno);
+		return -EINVAL;
+	}
+
 	/* btf_check_iter_kfuncs() ensures we don't need to validate anything here */
 	arg = &btf_params(meta->func_proto)[0];
 	t = btf_type_skip_modifiers(meta->btf, arg->type, NULL);	/* PTR */

base-commit: a4a971135a2ff64382ae4235b3ae60503bb1036a
-- 
2.43.0

Re: [PATCH 6.6.y v2] bpf: Ensure reg is PTR_TO_STACK in process_iter_arg

[Sasha Levin]

On Sat, Aug 29, 2026 at 11:27:48AM +0800, Xu Yunxiang wrote:
> [ Xu Yunxiang: Resolve the verifier.c context conflict by retaining the
>   6.6.y BTF lookup and its regno diagnostic convention. Omit the
>   verifier_bits_iter.c change because that selftest does not exist in
>   6.6.y. ]

Queued for 6.6, thanks.

-- 
Thanks,
Sasha