[v2] bpf: Compare iterator types during state pruning

[PATCH bpf-next v2 0/2] bpf: Compare iterator types during state pruning

Ning Ding posted 2 patches 1 month, 2 weeks ago

Diff against v1
Download series mbox

kernel/bpf/states.c                           |  3 +-
.../selftests/bpf/progs/iters_task_failure.c  | 46 +++++++++++++++++++
2 files changed, 48 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH bpf-next v2 0/2] bpf: Compare iterator types during state pruning

Posted by Ning Ding 1 month, 2 weeks ago

Iterator stack slots can be marked MEM_RCU or PTR_UNTRUSTED. The
STACK_ITER check in stacksafe() does not compare this type, so state
pruning can treat these states as equal and prune an unsafe path.

Compare the type and add a test where RCU protection has a gap.

---
Changes in v2:
- Convert the regression test to inline assembly so its verifier-sensitive
  control-flow layout is stable.
- Add Eduard Zingerman's Acked-by tag to patch 1.

v1: https://lore.kernel.org/bpf/20260807004320.134069-1-dingning04@gmail.com/

Ning Ding (2):
  bpf: Compare iterator types during state pruning
  selftests/bpf: Test RCU iterator state pruning

 kernel/bpf/states.c                           |  3 +-
 .../selftests/bpf/progs/iters_task_failure.c  | 46 +++++++++++++++++++
 2 files changed, 48 insertions(+), 1 deletion(-)

-- 
2.43.0