Re: [PATCH bpf-next 0/8] bpf: Fixes for may_goto, insn patching and iterator loops

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Fri Sep 25, 2026 at 1:31 AM CEST, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> Fixes for four bugs in may_goto, in patching of insns and in
> convergence of iterator loops, each followed by its tests.
>
> Patch 1: arch_bpf_timed_may_goto() on x86 computes the address of count
> and timestamp as rbp + offset. The prog with private stack keeps its
> stack in r9, so bpf_check_timed_may_goto() reads and writes the kernel
> stack, where r0-r5 have just been saved.
>
> Patch 3: [ST, ST, first insn] that inits may_goto count and
> [nospec, insn] move the insn down inside its own patch.
> bpf_adj_branches() doesn't look inside the patch, so a call, ld_imm64
> of a func or a jump that points backward lands short of its target
> by the number of insns in front of it.
>
> Patch 5: may_goto is expanded into a conditional jump with off + 5,
> off + 2 or off - 1 stored into 16 bits without a range check.
> may_goto +32763 jumps backward when it expires.
>
> Patch 7: states_equal() matches ids through idmap, so the loop is
> assumed to converge at bpf_iter_*_next() when the iterator was
> destroyed and created again since the old state. The prog that never
> ends is accepted.
>
> On x86-64 without the fixes may_goto_priv_stack, may_goto_far/32767,
> may_goto_far/-32768, both new tests of verifier_may_goto_1, "nospec in
> front of a call" (unpriv) and four "iter: remake ... jump to next"
> tests fail. With the fixes they pass.
>
> veristat on selftests, 5477 progs: no prog changes its verdict except
> the new "iter: remake" ones. Patch 7 adds insns to 16 progs that
> call bpf_iter_*_next() in a loop: 11010007 -> 11011495 insns in total,
> test_copy_from_user_dynptr 342 -> 470 is the largest in percent.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>

For the set:
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>