This is my program:

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

struct
{
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __type(key, __u32);
    __type(value, __u64);
    __uint(max_entries, 4);
} pkt_count SEC(".maps");

// count_packets atomically increases a packet counter on every invocation.
SEC("xdp")
int count_packets()
{
    int max = 100;
    for (int i = 0; i < max; i++)
    {
        __u64 *value = bpf_map_lookup_elem(&pkt_count, &i);
        if (!value)
        {
            return 0;
        }
        bpf_printk("%p", value);
    }

    return XDP_PASS;
}

char __license[] SEC("license") = "Dual MIT/GPL";

Why does the verifier detect an infinite loop in this code?

This is the output bpftool prog load counter_bpfel.o /sys/fs/bpf/my_prog command prints:

libbpf: prog 'count_packets': BPF program load failed: Invalid argument
libbpf: prog 'count_packets': -- BEGIN PROG LOAD LOG --
; int count_packets()
0: (b7) r6 = 0
; 
1: (63) *(u32 *)(r10 -4) = r6
last_idx 1 first_idx 0
regs=40 stack=0 before 0: (b7) r6 = 0
2: (b7) r7 = 28709
3: (b7) r8 = 99
4: (bf) r2 = r10
5: (07) r2 += -4
; __u64 *value = bpf_map_lookup_elem(&pkt_count, &i);
6: (18) r1 = 0xffff906dfb349e00
8: (85) call bpf_map_lookup_elem#1
; if (!value)
9: (15) if r0 == 0x0 goto pc+16
 R0_w=map_value(id=0,off=0,ks=4,vs=8,imm=0) R6_w=inv0 R7_w=inv28709 R8_w=inv99 R10=fp0 fp-8=mmmm????
; bpf_printk("%p", value);
10: (73) *(u8 *)(r10 -6) = r6
last_idx 10 first_idx 0
regs=40 stack=0 before 9: (15) if r0 == 0x0 goto pc+16
regs=40 stack=0 before 8: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 6: (18) r1 = 0xffff906dfb349e00
regs=40 stack=0 before 5: (07) r2 += -4
regs=40 stack=0 before 4: (bf) r2 = r10
regs=40 stack=0 before 3: (b7) r8 = 99
regs=40 stack=0 before 2: (b7) r7 = 28709
regs=40 stack=0 before 1: (63) *(u32 *)(r10 -4) = r6
regs=40 stack=0 before 0: (b7) r6 = 0
11: (6b) *(u16 *)(r10 -8) = r7
12: (bf) r1 = r10
; 
13: (07) r1 += -8
; bpf_printk("%p", value);
14: (b7) r2 = 3
15: (bf) r3 = r0
16: (85) call bpf_trace_printk#6
last_idx 16 first_idx 0
regs=4 stack=0 before 15: (bf) r3 = r0
regs=4 stack=0 before 14: (b7) r2 = 3
; for (int i = 0; i < max; i++)
17: (61) r1 = *(u32 *)(r10 -4)
18: (bf) r2 = r1
19: (07) r2 += 1
; 
20: (63) *(u32 *)(r10 -4) = r2
; for (int i = 0; i < max; i++)
21: (67) r1 <<= 32
22: (c7) r1 s>>= 32
; for (int i = 0; i < max; i++)
23: (6d) if r8 s> r1 goto pc-20

from 23 to 4: R0=inv(id=0) R1_w=inv(id=0,smin_value=-2147483648,smax_value=98) R2_w=inv(id=0,umin_value=1,umax_value=4294967296,var_off=(0x0; 0x1ffffffff)) R6=inv0 R7=inv28709 R8=inv99 R10=fp0 fp-8=mmmm?mmm
; 
4: (bf) r2 = r10
5: (07) r2 += -4
; __u64 *value = bpf_map_lookup_elem(&pkt_count, &i);
6: (18) r1 = 0xffff906dfb349e00
8: (85) call bpf_map_lookup_elem#1
; if (!value)
9: (15) if r0 == 0x0 goto pc+16
 R0_w=map_value(id=0,off=0,ks=4,vs=8,imm=0) R6=inv0 R7=inv28709 R8=inv99 R10=fp0 fp-8=mmmm?mmm
; bpf_printk("%p", value);
10: (73) *(u8 *)(r10 -6) = r6
last_idx 10 first_idx 17
regs=40 stack=0 before 9: (15) if r0 == 0x0 goto pc+16
regs=40 stack=0 before 8: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 6: (18) r1 = 0xffff906dfb349e00
regs=40 stack=0 before 5: (07) r2 += -4
regs=40 stack=0 before 4: (bf) r2 = r10
regs=40 stack=0 before 23: (6d) if r8 s> r1 goto pc-20
regs=40 stack=0 before 22: (c7) r1 s>>= 32
regs=40 stack=0 before 21: (67) r1 <<= 32
regs=40 stack=0 before 20: (63) *(u32 *)(r10 -4) = r2
regs=40 stack=0 before 19: (07) r2 += 1
regs=40 stack=0 before 18: (bf) r2 = r1
regs=40 stack=0 before 17: (61) r1 = *(u32 *)(r10 -4)
 R0_w=inv(id=0) R6_rw=invP0 R7_w=inv28709 R8_rw=inv99 R10=fp0 fp-8_r=mmmm?mmm
parent didn't have regs=40 stack=0 marks
last_idx 16 first_idx 0
regs=40 stack=0 before 16: (85) call bpf_trace_printk#6
regs=40 stack=0 before 15: (bf) r3 = r0
regs=40 stack=0 before 14: (b7) r2 = 3
regs=40 stack=0 before 13: (07) r1 += -8
regs=40 stack=0 before 12: (bf) r1 = r10
regs=40 stack=0 before 11: (6b) *(u16 *)(r10 -8) = r7
regs=40 stack=0 before 10: (73) *(u8 *)(r10 -6) = r6
regs=40 stack=0 before 9: (15) if r0 == 0x0 goto pc+16
regs=40 stack=0 before 8: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 6: (18) r1 = 0xffff906dfb349e00
regs=40 stack=0 before 5: (07) r2 += -4
regs=40 stack=0 before 4: (bf) r2 = r10
regs=40 stack=0 before 3: (b7) r8 = 99
regs=40 stack=0 before 2: (b7) r7 = 28709
regs=40 stack=0 before 1: (63) *(u32 *)(r10 -4) = r6
regs=40 stack=0 before 0: (b7) r6 = 0
11: (6b) *(u16 *)(r10 -8) = r7
12: (bf) r1 = r10
; 
13: (07) r1 += -8
; bpf_printk("%p", value);
14: (b7) r2 = 3
15: (bf) r3 = r0
16: (85) call bpf_trace_printk#6
last_idx 16 first_idx 17
regs=4 stack=0 before 15: (bf) r3 = r0
regs=4 stack=0 before 14: (b7) r2 = 3
; for (int i = 0; i < max; i++)
infinite loop detected at insn 17
processed 39 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1
-- END PROG LOAD LOG --
libbpf: prog 'count_packets': failed to load: -22
libbpf: failed to load object 'counter_bpfel.o'
Error: failed to load object file

I really don’t know where in that loop an infinite loop can be detected.

When I see a problem occurring when a helper function is added, it seems like there is some secret in the helper function, but I can’t figure out the secret.

Please help me!