[PATCH bpf-next 0/2] bpf: Compare iterator types during state pruning

[PATCH bpf-next 0/2] bpf: Compare iterator types during state pruning

[Ning Ding]

Iterator stack slots can be marked MEM_RCU or PTR_UNTRUSTED. The
STACK_ITER check in stacksafe() does not compare this type, so state
pruning can treat these states as equal and prune an unsafe path.

Compare the type and add a test where RCU protection has a gap.

Ning Ding (2):
  bpf: Compare iterator types during state pruning
  selftests/bpf: Test RCU iterator state pruning

 kernel/bpf/states.c                           |  3 ++-
 .../selftests/bpf/progs/iters_task_failure.c  | 27 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH bpf-next 1/2] bpf: Compare iterator types during state pruning

[Ning Ding]

An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states
must not be equal, or the verifier can prune an unsafe path.

Compare the pointer type for STACK_ITER slots.

Fixes: dfab99df147b ("bpf: teach the verifier to enforce css_iter and task_iter in RCU CS")
Signed-off-by: Ning Ding <dingning04@gmail.com>
---
 kernel/bpf/states.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c
index ea2153cf28d0a..4e6aafad33bd2 100644
--- a/kernel/bpf/states.c
+++ b/kernel/bpf/states.c
@@ -812,7 +812,8 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old,
 			 * infinite loop check triggering, see
 			 * iter_active_depths_differ()
 			 */
-			if (old_reg->iter.btf != cur_reg->iter.btf ||
+			if (old_reg->type != cur_reg->type ||
+			    old_reg->iter.btf != cur_reg->iter.btf ||
 			    old_reg->iter.btf_id != cur_reg->iter.btf_id ||
 			    old_reg->iter.state != cur_reg->iter.state ||
 			    /* ignore {old_reg,cur_reg}->iter.depth, see above */
-- 
2.43.0

[PATCH bpf-next 2/2] selftests/bpf: Test RCU iterator state pruning

[Ning Ding]

Add a path where RCU protection reaches zero and then starts again.
The iterator is untrusted after this gap and must be rejected.

Signed-off-by: Ning Ding <dingning04@gmail.com>
---
 .../selftests/bpf/progs/iters_task_failure.c  | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/iters_task_failure.c b/tools/testing/selftests/bpf/progs/iters_task_failure.c
index fe3663dedbe14..bac394ae77f44 100644
--- a/tools/testing/selftests/bpf/progs/iters_task_failure.c
+++ b/tools/testing/selftests/bpf/progs/iters_task_failure.c
@@ -61,6 +61,33 @@ int BPF_PROG(iter_tasks_lock_and_unlock)
 	return 0;
 }
 
+SEC("?fentry.s/" SYS_PREFIX "sys_getpgid")
+__failure __msg("expected an RCU CS when using bpf_iter_task_next")
+__flag(BPF_F_TEST_STATE_FREQ)
+int BPF_PROG(iter_tasks_rcu_state_pruning)
+{
+	struct bpf_iter_task it;
+
+	bpf_rcu_read_lock();
+	bpf_iter_task_new(&it, NULL, BPF_TASK_ITER_ALL_PROCS);
+
+	if (likely(bpf_get_prandom_u32())) {
+		/* Keep the outer RCU lock active. */
+		bpf_rcu_read_lock();
+		bpf_rcu_read_unlock();
+	} else {
+		/* Create an unprotected gap. */
+		bpf_rcu_read_unlock();
+		bpf_rcu_read_lock();
+	}
+
+	bpf_iter_task_next(&it);
+	bpf_iter_task_destroy(&it);
+	bpf_rcu_read_unlock();
+
+	return 0;
+}
+
 SEC("?fentry.s/" SYS_PREFIX "sys_getpgid")
 __failure __msg("expected an RCU CS when using bpf_iter_css_next")
 int BPF_PROG(iter_css_lock_and_unlock)
-- 
2.43.0

Re: [PATCH bpf-next 1/2] bpf: Compare iterator types during state pruning

[Eduard Zingerman]

On Thu, 2026-08-06 at 17:43 -0700, Ning Ding wrote:
> An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states
> must not be equal, or the verifier can prune an unsafe path.
> 
> Compare the pointer type for STACK_ITER slots.
> 
> Fixes: dfab99df147b ("bpf: teach the verifier to enforce css_iter and task_iter in RCU CS")
> Signed-off-by: Ning Ding <dingning04@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

...

Re: [PATCH bpf-next 2/2] selftests/bpf: Test RCU iterator state pruning

[Eduard Zingerman]

On Thu, 2026-08-06 at 17:43 -0700, Ning Ding wrote:

...

> +SEC("?fentry.s/" SYS_PREFIX "sys_getpgid")
> +__failure __msg("expected an RCU CS when using bpf_iter_task_next")
> +__flag(BPF_F_TEST_STATE_FREQ)
> +int BPF_PROG(iter_tasks_rcu_state_pruning)
> +{
> +	struct bpf_iter_task it;
> +
> +	bpf_rcu_read_lock();
> +	bpf_iter_task_new(&it, NULL, BPF_TASK_ITER_ALL_PROCS);
> +
> +	if (likely(bpf_get_prandom_u32())) {

Could you please convert this test to inline assembly?
The presence of 'likely' might not be sufficient to guarantee
the codegen pattern, so we usually resort to the assembly for
tests where that is important.

> +		/* Keep the outer RCU lock active. */
> +		bpf_rcu_read_lock();
> +		bpf_rcu_read_unlock();
> +	} else {
> +		/* Create an unprotected gap. */
> +		bpf_rcu_read_unlock();
> +		bpf_rcu_read_lock();
> +	}
> +
> +	bpf_iter_task_next(&it);
> +	bpf_iter_task_destroy(&it);
> +	bpf_rcu_read_unlock();
> +
> +	return 0;
> +}
> +
>  SEC("?fentry.s/" SYS_PREFIX "sys_getpgid")
>  __failure __msg("expected an RCU CS when using bpf_iter_css_next")
>  int BPF_PROG(iter_css_lock_and_unlock)

Re: [PATCH bpf-next 2/2] selftests/bpf: Test RCU iterator state pruning

[Ning Ding]

> Could you please convert this test to inline assembly?
> The presence of 'likely' might not be sufficient to guarantee
> the codegen pattern, so we usually resort to the assembly for
> tests where that is important.
Sure, I will fix and resubmit.