[PATCH bpf-next v2] bpf: Fix bpf_loop() depth check to use 32-bit max for nr_loops
From: Ömer Mete Kaya
Date: Sun Sep 27 2026 - 20:16:53 EST
The verifier compares callback_depth (u32) against reg_umax(), which
returns the 64-bit upper bound of R1. If the upper 32 bits of R1 are
set, reg_umax() can be U64_MAX, causing the depth check to be
ineffective and triggering excessive push_callback_call() invocations
until the complexity limit is hit.
Use reg_u32_max() instead. The change is sound for both runtime paths:
Out-of-line helper path (kernel/bpf/bpf_iter.c):
bpf_loop() takes nr_loops as u32 via BPF_CALL_4, so the runtime
always truncates R1 to 32 bits. reg_u32_max() matches this exactly.
Inlined path (kernel/bpf/fixups.c, inline_bpf_loop):
When fit_for_inline is set, the call is replaced with inline code
that checks R1 against BPF_MAX_LOOPS (8M) using a 64-bit compare:
BPF_JMP_IMM(BPF_JLE, BPF_REG_1, BPF_MAX_LOOPS, 2);
Any R1 with upper 32 bits set exceeds BPF_MAX_LOOPS and returns
-E2BIG with zero iterations. Any R1 that passes the check fits
within BPF_MAX_LOOPS < U32_MAX, so (u32)R1 == R1. In both cases
reg_u32_max() correctly bounds the iteration count.
Signed-off-by: Ömer Mete Kaya <omermetekaya0@xxxxxxxxx>
---
Changes in v2:
- Expand commit message to cover the inlined bpf_loop() path
(inline_bpf_loop in fixups.c). Requested by bpf-ci bot.
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6bc5bc56f0d3..6ef037ca18c4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12185,7 +12185,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
err = mark_chain_precision(env, BPF_REG_1);
if (err)
return err;
- if (cur_func(env)->callback_depth < reg_umax(®s[BPF_REG_1])) {
+ if (cur_func(env)->callback_depth < reg_u32_max(®s[BPF_REG_1])) {
err = push_callback_call(env, insn, insn_idx, meta.subprogno,
set_loop_callback_state);
} else {
--
2.55.0