bpf: abort verification if env->cur_state->loop_entry != NULL

In addition to warning abort verification with -EFAULT.
If env->cur_state->loop_entry != NULL something is irrecoverably
buggy.

Fixes: bbbc02b7445e ("bpf: copy_verifier_state() should copy 'loop_entry' field")
Suggested-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20250225003838.135319-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5c9b7464ec2c9fba9955230d5744cd6d18bfa3d7..942c0d2df258a88dd6ec0f9de402655897f567b3 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19340,8 +19340,10 @@ process_bpf_exit:
                                                return err;
                                        break;
                                } else {
-                                       if (WARN_ON_ONCE(env->cur_state->loop_entry))
-                                               env->cur_state->loop_entry = NULL;
+                                       if (WARN_ON_ONCE(env->cur_state->loop_entry)) {
+                                               verbose(env, "verifier bug: env->cur_state->loop_entry != NULL\n");
+                                               return -EFAULT;
+                                       }
                                        do_print_state = true;
                                        continue;
                                }