Iterator stack slots can be marked MEM_RCU or PTR_UNTRUSTED. The STACK_ITER check in stacksafe() does not compare this type, so state pruning can treat these states as equal and prune an unsafe path.
Compare the type and add a test where RCU protection has a gap. --- Changes in v2: - Convert the regression test to inline assembly so its verifier-sensitive control-flow layout is stable. - Add Eduard Zingerman's Acked-by tag to patch 1. v1: https://lore.kernel.org/bpf/[email protected]/ Ning Ding (2): bpf: Compare iterator types during state pruning selftests/bpf: Test RCU iterator state pruning kernel/bpf/states.c | 3 +- .../selftests/bpf/progs/iters_task_failure.c | 46 +++++++++++++++++++ 2 files changed, 48 insertions(+), 1 deletion(-) -- 2.43.0
