Re: [PATCH bpf v1 1/2] bpf: Reject non-scalar bpf_loop iteration counts

[Eduard Zingerman <eddyz87@gmail.com>]

On Sat, 2026-09-05 at 03:47 +0200, Kumar Kartikeya Dwivedi wrote:
> bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged
> programs may pass pointer values to such arguments, so check_func_arg()
> lets a pointer-valued R1 reach the helper-specific checks.
> 
> Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop
> callback iterations"), the verifier marks R1 precise and reads its upper
> bound to limit callback simulation. Precision backtracking only accepts
> scalar registers, so passing a pointer instead triggers the "backtracking
> misuse" verifier warning. Kernels with panic_on_warn enabled subsequently
> panic.
> 
> Introduce ARG_SCALAR for helper arguments that only accept scalar values
> and use it for bpf_loop() nr_loops. Generic helper argument validation then
> rejects pointers before loop inlining and precision processing.
> 
> Fixes: bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations")
> Reported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com/
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

Looks like there are no other instances of this bug.