[PATCH bpf-next v2 0/2] bpf: Fix loop detection for re-arming async callbacks

[Puranjay Mohan <puranjay@kernel.org>]

Changelog:
v1: https://lore.kernel.org/all/20260923140152.4005097-1-puranjay@kernel.org/
Changes in v2:
- Patch 1: also fix push_callback_call(), which numbered a new entry
  from the caller frame. When the callback re-arms from a subprog that
  frame is not frame 0 and its count is 0, so every entry was numbered 1,
  is_state_visited() never saw a difference, and a loop in such a
  callback was still rejected.
- Patch 2: loop_cb() now re-arms through a __noinline subprog, so the
  caller frame at bpf_timer_set_callback() is not the callback's own
  frame. The v1 test re-armed from frame 0 and passed without the
  push_callback_call() fix.

push_async_cb() sets in_async_callback_fn and async_entry_cnt on the
callback's own frame, which is frame 0 of the fresh state it starts, and
setup_func_entry() copies neither, so a subprog called by the callback
carries neither. Two places read them from the innermost frame instead.

is_state_visited() skips the infinite loop check when two states differ in
async_entry_cnt, since seeing the same state on a second entry into an
async callback is not a loop. push_callback_call() assigns that count as
the caller's plus one.

A callback which re-arms itself and calls a subprog therefore has its two
entries compared at a loop inside that subprog, where the innermost frame
is the subprog's, and both entries are numbered 1 anyway, so it is
rejected:

  infinite loop detected at insn 57

Patch 1 reads both from frame 0 in both places, which push_async_cb() makes
the callback's frame at any call depth. A loop within a single entry still
has a matching count and is still caught.

Patch 2 covers both directions: a timer callback which re-arms through
bpf_timer_set_callback() from a subprog and reaches a bounded loop through
another one, which fails to load without patch 1, and a callback which
never returns, which must still be rejected either way. Nothing covered an
async callback before, so neither direction was tested.

Puranjay Mohan (2):
  bpf: Look at frame 0 when telling async callback entries apart
  selftests/bpf: Add timer tests for a re-arming callback with a loop

 kernel/bpf/states.c                           |  4 +-
 kernel/bpf/verifier.c                         |  2 +-
 .../testing/selftests/bpf/prog_tests/timer.c  | 33 ++++++++++
 tools/testing/selftests/bpf/progs/timer.c     | 60 ++++++++++++++++++-
 .../selftests/bpf/progs/timer_failure.c       | 29 +++++++++
 5 files changed, 124 insertions(+), 4 deletions(-)


base-commit: 4f3a5eae895b9995e93425a75235d8f1f3268caa
-- 
2.53.0-Meta