Re: [PATCH bpf v1 1/2] bpf: Compare stack frames in regs_exact()

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Mon Sep 14, 2026 at 6:33 PM CEST, Eduard Zingerman wrote:
> On Mon, 2026-09-14 at 18:13 +0200, Kumar Kartikeya Dwivedi wrote:
>> regs_exact() compares the register state up to id, followed by the ID
>> mappings, but does not compare frameno. The PTR_TO_STACK case in regsafe()
>> checks frameno separately, which is bypassed when exact comparison is
>> requested. Consequently, infinite-loop detection can treat pointers to
>> different stack frames as the same pointer and reject a finite loop.
>>
>> For example, initialize fp-8 to zero in the caller and to one in the
>> callee, then pass the caller's fp-8 to the callee as r1:
>>
>>     loop:
>>         r0 = *(u64 *)(r1 + 0);
>>         if r0 != 0 goto done;
>>         r1 = r10;
>>         r1 += -8;
>>         goto loop;
>>     done:
>>         exit;
>>
>> The loop terminates after reading the callee's slot on its second
>> iteration. At the loop header, however, the only relevant difference is
>> r1's frameno, so exact comparison incorrectly reports an infinite loop.
>> The same problem occurs when the pointer is spilled to the stack.
>>
>> Include frameno in regs_exact() so both exact and ordinary stack-pointer
>> comparisons enforce it. The field stays zero for other register types.
>>
>> Continue to ignore precise. Precision marks control whether pruning may
>> ignore scalar ranges; they do not change the represented values, and exact
>> comparison already compares those ranges unconditionally. Marks can also
>> change through backtracking while an ancestor state is still being
>> explored.
>>
>> Fixes: d5b892fd607a ("bpf: make infinite loop detection in is_state_visited() exact")
>> Reported-by: Eduard Zingerman <eddyz87@gmail.com>
>> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>> ---
>
> I'm going to land '[PATCH bpf v3 0/7] Misc bug fixes - part 5',
> which would be in conflict with this one.
> After that, could you please respin, but try to move frameno inside
> the bpf_reg_state's union or near the delta field?
>
> ...

Makes sense, will do.