[PATCH bpf-next 1/2] bpf: Compare iterator types during state pruning

[Ning Ding]

An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states
must not be equal, or the verifier can prune an unsafe path.

Compare the pointer type for STACK_ITER slots.

Fixes: dfab99df147b ("bpf: teach the verifier to enforce css_iter and task_iter 
in RCU CS")
Signed-off-by: Ning Ding <dingnin...@gmail.com>
---
 kernel/bpf/states.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/states.c b/kernel/bpf/states.c
index ea2153cf28d0a..4e6aafad33bd2 100644
--- a/kernel/bpf/states.c
+++ b/kernel/bpf/states.c
@@ -812,7 +812,8 @@ static bool stacksafe(struct bpf_verifier_env *env, struct 
bpf_func_state *old,
                         * infinite loop check triggering, see
                         * iter_active_depths_differ()
                         */
-                       if (old_reg->iter.btf != cur_reg->iter.btf ||
+                       if (old_reg->type != cur_reg->type ||
+                           old_reg->iter.btf != cur_reg->iter.btf ||
                            old_reg->iter.btf_id != cur_reg->iter.btf_id ||
                            old_reg->iter.state != cur_reg->iter.state ||
                            /* ignore {old_reg,cur_reg}->iter.depth, see above 
*/
-- 
2.43.0