Re: [PATCH bpf v2 1/2] bpf: Compare stack frames in regs_exact()

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-09-18 at 03:13 +0200, Kumar Kartikeya Dwivedi wrote:
> regs_exact() compares the register state up to id, followed by the ID
> mappings, but does not compare frameno. The PTR_TO_STACK case in regsafe()
> checks frameno separately, which is bypassed when exact comparison is
> requested. Consequently, infinite-loop detection can treat pointers to
> different stack frames as the same pointer and reject a finite loop.
> 
> For example, initialize fp-8 to zero in the caller and to one in the
> callee, then pass the caller's fp-8 to the callee as r1:
> 
>     loop:
>         r0 = *(u64 *)(r1 + 0);
>         if r0 != 0 goto done;
>         r1 = r10;
>         r1 += -8;
>         goto loop;
>     done:
>         exit;
> 
> The loop terminates after reading the callee's slot on its second
> iteration. At the loop header, however, the only relevant difference is
> r1's frameno, so exact comparison incorrectly reports an infinite loop.
> The same problem occurs when the pointer is spilled to the stack.
> 
> Move frameno into the type-specific metadata union, ahead of id, so the
> existing prefix comparison in regs_exact() covers it. Ordinary stack
> pointers do not use another union member. Iterator and IRQ stack-slot
> states use their dedicated union views and do not need a frame lookup.
> This also keeps bpf_reg_state at 80 bytes.
> 
> Move the states_maybe_looping() boundary from frameno to precise after the
> field relocation. Its prefix comparison continues to cover the complete
> value state and now includes frameno.
> 
> Continue to ignore precise. Precision marks control whether pruning may
> ignore scalar ranges; they do not change the represented values, and exact
> comparison already compares those ranges unconditionally. Marks can also
> change through backtracking while an ancestor state is still being
> explored.
> 
> Fixes: d5b892fd607a ("bpf: make infinite loop detection in is_state_visited() exact")
> Reported-by: Eduard Zingerman <eddyz87@gmail.com>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...