The verifier compares callback_depth (u32) against reg_umax(), which returns the 64-bit upper bound of R1. If the upper 32 bits of R1 are set, reg_umax() can be U64_MAX, causing the depth check to be ineffective and triggering excessive push_callback_call() invocations until the complexity limit is hit. Use reg_u32_max() instead. The change is sound for both runtime paths: Out-of-line helper path (kernel/bpf/bpf_iter.c): bpf_loop() takes nr_loops as u32 via BPF_CALL_4, so the runtime always truncates R1 to 32 bits. reg_u32_max() matches this exactly. Inlined path (kernel/bpf/fixups.c, inline_bpf_loop): When fit_for_inline is set, the call is replaced with inline code that checks R1 against BPF_MAX_LOOPS (8M) using a 64-bit compare: BPF_JMP_IMM(BPF_JLE, BPF_REG_1, BPF_MAX_LOOPS, 2); Any R1 with upper 32 bits set exceeds BPF_MAX_LOOPS and returns -E2BIG with zero iterations. Any R1 that passes the check fits within BPF_MAX_LOOPS < U32_MAX, so (u32)R1 == R1. In both cases reg_u32_max() correctly bounds the iteration count. Signed-off-by: Ömer Mete Kaya --- Changes in v2: - Expand commit message to cover the inlined bpf_loop() path (inline_bpf_loop in fixups.c). Requested by bpf-ci bot. kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6bc5bc56f0d3..6ef037ca18c4 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12185,7 +12185,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn err = mark_chain_precision(env, BPF_REG_1); if (err) return err; - if (cur_func(env)->callback_depth < reg_umax(®s[BPF_REG_1])) { + if (cur_func(env)->callback_depth < reg_u32_max(®s[BPF_REG_1])) { err = push_callback_call(env, insn, insn_idx, meta.subprogno, set_loop_callback_state); } else { -- 2.55.0