Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: abort verification if env->cur_state->loop_entry != NULL

In addition to warning abort verification with -EFAULT.
If env->cur_state->loop_entry != NULL something is irrecoverably
buggy.

Fixes: bbbc02b7445e ("bpf: copy_verifier_state() should copy 'loop_entry' field")
Suggested-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20250225003838.135319-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Eduard Zingerman and committed by
Alexei Starovoitov
f3c2d243 1ffe30ef

+4 -2
+4 -2
kernel/bpf/verifier.c
··· 19340 19340 return err; 19341 19341 break; 19342 19342 } else { 19343 - if (WARN_ON_ONCE(env->cur_state->loop_entry)) 19344 - env->cur_state->loop_entry = NULL; 19343 + if (WARN_ON_ONCE(env->cur_state->loop_entry)) { 19344 + verbose(env, "verifier bug: env->cur_state->loop_entry != NULL\n"); 19345 + return -EFAULT; 19346 + } 19345 19347 do_print_state = true; 19346 19348 continue; 19347 19349 }