[PATCH bpf v2 0/2] Compare stack frames in exact register states

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

regs_exact() compares register values and their ID relationships, but it
does not compare frameno. regsafe() checks frameno for ordinary
PTR_TO_STACK comparisons, while its EXACT path returns through regs_exact()
before reaching that check. Infinite-loop detection can therefore mistake
pointers to the same offset in different stack frames for the same pointer
and reject a finite loop.

Move frameno into bpf_reg_state's type-specific metadata union so the
existing regs_exact() prefix comparison covers it. This avoids a separate
PTR_TO_STACK case and keeps the structure at 80 bytes. Adjust the
states_maybe_looping() comparison boundary for the new layout.

The selftests cover both a live register and a spilled stack pointer. On
the unfixed tree, both programs are rejected with "infinite loop detected".
With the fix, both load and return the expected value.

Changelog:
----------
v1 -> v2
v1: https://lore.kernel.org/bpf/20260914161340.3419141-1-memxor@gmail.com

 * Rebase on bpf/master.
 * Move frameno into the type-specific metadata union so regs_exact()'s
   existing prefix comparison covers it without growing bpf_reg_state.

Kumar Kartikeya Dwivedi (2):
  bpf: Compare stack frames in regs_exact()
  selftests/bpf: Cover frame changes in bounded loops

 include/linux/bpf_verifier.h                  | 16 ++---
 kernel/bpf/states.c                           |  7 +-
 .../selftests/bpf/progs/verifier_loops1.c     | 70 +++++++++++++++++++
 3 files changed, 80 insertions(+), 13 deletions(-)


base-commit: 3b8e5d9f2ed7abf18ebe63b7a6a4a64e1a9c2203
-- 
2.53.0