[PATCH bpf-next 0/2] bpf: Fix loop detection for re-arming async callbacks

[Puranjay Mohan <puranjay@kernel.org>]

is_state_visited() skips the infinite loop check when two states differ in
async_entry_cnt, since seeing the same state on a second entry into an
async callback is not a loop. It reads that from the innermost frame, but
push_async_cb() sets in_async_callback_fn and async_entry_cnt on the
callback's own frame, and setup_func_entry() copies neither, so a subprog
called by the callback carries neither.

A callback which re-arms itself and calls a subprog therefore has its two
entries compared at a loop inside that subprog, and is rejected:

  infinite loop detected at insn 57

Patch 1 reads both from frame 0, which push_async_cb() makes the callback's
frame at any call depth.

Patch 2 covers both directions: a timer callback which re-arms through
bpf_timer_set_callback() and reaches a bounded loop through a static
subprog, which fails to load without patch 1, and a callback which never
returns, which must still be rejected either way. Nothing covered an async
callback before, so neither direction was tested.

Puranjay Mohan (2):
  bpf: Look at frame 0 when telling async callback entries apart
  selftests/bpf: Add timer tests for a re-arming callback with a loop

 kernel/bpf/states.c                           |  4 +-
 .../testing/selftests/bpf/prog_tests/timer.c  | 33 ++++++++++++
 tools/testing/selftests/bpf/progs/timer.c     | 50 ++++++++++++++++++-
 .../selftests/bpf/progs/timer_failure.c       | 29 +++++++++++
 4 files changed, 113 insertions(+), 3 deletions(-)


base-commit: 91f8613d95ad8cd99d8baf094806d1ef98bc6380
-- 
2.53.0-Meta