[PATCH bpf-next v2] bpf: Fix bpf_loop() depth check to use 32-bit max for nr_loops

[PATCH bpf-next v2] bpf: Fix bpf_loop() depth check to use 32-bit max for nr_loops

[Ömer Mete Kaya]

The verifier compares callback_depth (u32) against reg_umax(), which
returns the 64-bit upper bound of R1. If the upper 32 bits of R1 are
set, reg_umax() can be U64_MAX, causing the depth check to be
ineffective and triggering excessive push_callback_call() invocations
until the complexity limit is hit.

Use reg_u32_max() instead. The change is sound for both runtime paths:

Out-of-line helper path (kernel/bpf/bpf_iter.c):
  bpf_loop() takes nr_loops as u32 via BPF_CALL_4, so the runtime
  always truncates R1 to 32 bits. reg_u32_max() matches this exactly.

Inlined path (kernel/bpf/fixups.c, inline_bpf_loop):
  When fit_for_inline is set, the call is replaced with inline code
  that checks R1 against BPF_MAX_LOOPS (8M) using a 64-bit compare:

    BPF_JMP_IMM(BPF_JLE, BPF_REG_1, BPF_MAX_LOOPS, 2);

  Any R1 with upper 32 bits set exceeds BPF_MAX_LOOPS and returns
  -E2BIG with zero iterations. Any R1 that passes the check fits
  within BPF_MAX_LOOPS < U32_MAX, so (u32)R1 == R1. In both cases
  reg_u32_max() correctly bounds the iteration count.

Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
Changes in v2:
  - Expand commit message to cover the inlined bpf_loop() path
    (inline_bpf_loop in fixups.c). Requested by bpf-ci bot.

 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6bc5bc56f0d3..6ef037ca18c4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12185,7 +12185,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		err = mark_chain_precision(env, BPF_REG_1);
 		if (err)
 			return err;
-		if (cur_func(env)->callback_depth < reg_umax(&regs[BPF_REG_1])) {
+		if (cur_func(env)->callback_depth < reg_u32_max(&regs[BPF_REG_1])) {
 			err = push_callback_call(env, insn, insn_idx, meta.subprogno,
 						 set_loop_callback_state);
 		} else {
--
2.55.0

Re: [PATCH bpf-next v2] bpf: Fix bpf_loop() depth check to use 32-bit max for nr_loops

[Alexei Starovoitov]

On Mon, Sep 28, 2026 at 03:15 AM Ömer Mete Kaya <omermetekaya0@gmail.com> wrote:
> The verifier compares callback_depth (u32) against reg_umax(), which
> returns the 64-bit upper bound of R1. If the upper 32 bits of R1 are
> set, reg_umax() can be U64_MAX, causing the depth check to be
> ineffective and triggering excessive push_callback_call() invocations
> until the complexity limit is hit.
>
> Use reg_u32_max() instead. The change is sound for both runtime paths:

It's not a fix. Nothing is broken.

pls stop the spam.

pw-bot: cr