Iterator stack slots can be marked MEM_RCU or PTR_UNTRUSTED. The STACK_ITER check in stacksafe() does not compare this type, so state pruning can treat these states as equal and prune an unsafe path.
Compare the type and add a test where RCU protection has a gap. Ning Ding (2): bpf: Compare iterator types during state pruning selftests/bpf: Test RCU iterator state pruning kernel/bpf/states.c | 3 ++- .../selftests/bpf/progs/iters_task_failure.c | 27 +++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) -- 2.43.0

