Re: [PATCH bpf-next 01/17] bpf: Fix infinite loop in check_max_stack_depth()

[Eduard Zingerman <eddyz87@gmail.com>]

On Tue, 2026-09-22 at 01:13 +0000, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> sort_subprogs_topo() rejects recursion via direct calls, but allows cycles
> that go through ld_imm64 BPF_PSEUDO_FUNC, since the address could be taken
> for an async callback. The main verifier pass limits the number of frames,
> but it doesn't follow calls into global functions.
> So the following program passes both:
> 
>   static int cb(u32 i, void *ctx) { return foo(i); }
>   static int foo(int x)           { return bar(x); }
>   int bar(int x)                  { bpf_loop(1, cb, NULL, 0); return 0; }
> 
>   SEC("socket") int prog(void *ctx) { return cb(0, NULL); }
> 
> cb -> foo -> bar -> bpf_loop -> cb is unbounded recursion.
> check_max_stack_depth_subprog() walks this cycle too. None of
> the functions use stack and the frame counter is reset by every global
> function, so neither stack size nor frame limit is hit and bpf_prog_load()
> spins forever.
> 
> Reject a call into a subprog that is already in the chain of callers.
> Async callbacks are skipped earlier and are not affected.
> 
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...