[PATCH bpf v1 0/2] bpf: Compare stack frames in exact register states

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

regs_exact() compares the value-bearing portion of bpf_reg_state and its
IDs, but excludes frameno. regsafe() compensates for that omission in its
PTR_TO_STACK case. An EXACT comparison returns through regs_exact() before
reaching that case, however, so infinite-loop detection can equate pointers
to the same offset in different stack frames.

A finite loop can expose the problem by first reading zero from fp-8 in its
caller, then changing its pointer to fp-8 in the callee, where the slot holds
one. The current verifier reports an infinite loop at the second visit even
though the next load makes the loop exit. A spilled pointer has the same
problem.

Include frameno in regs_exact() so every caller observes it. Keep precise
excluded: a precision mark records whether pruning may
ignore scalar ranges, while exact comparison already compares those ranges
unconditionally. Precision marks can also change through backtracking while
an ancestor state is still active.

The second patch adds register and spill variants of the finite loop. Both
are rejected with "infinite loop detected" before the fix and pass after it.

Kumar Kartikeya Dwivedi (2):
  bpf: Compare stack frames in regs_exact()
  selftests/bpf: Cover frame changes in bounded loops

 kernel/bpf/states.c                           |  8 +--
 .../selftests/bpf/progs/verifier_loops1.c     | 66 +++++++++++++++++++
 2 files changed, 69 insertions(+), 5 deletions(-)


base-commit: ee363e055895364039bf28348ff13c615afad4ba
-- 
2.53.0