[PATCH bpf-next v4 4/6] bpf: Inline bpf_iter_num_destroy() as a no-op

[Puranjay Mohan <puranjay@kernel.org>]

bpf_iter_num_destroy() ends every bpf_for() loop. The kfunc only zeroed
the 8-byte on-stack iterator state, but once destroy() returns that slot
is no longer tracked as iterator state, so nothing reads it and the
zeroing is dead work.

Drop it on both sides: make the bpf_iter_num_destroy() kfunc a no-op, and
inline the call in bpf_fixup_kfunc_call() to a single BPF_JA 0 (nop) so
the per-loop call is removed without emitting any store. The nop is
elided by the JITs.

The emitted instruction is plain BPF and is handled by the interpreter,
so interpreter fallback stays correct and no jit_required marking is
needed.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
---
 kernel/bpf/bpf_iter.c |  8 +++++---
 kernel/bpf/verifier.c | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
index f190f2b250048..ff2055399f3c0 100644
--- a/kernel/bpf/bpf_iter.c
+++ b/kernel/bpf/bpf_iter.c
@@ -821,9 +821,11 @@ __bpf_kfunc int *bpf_iter_num_next(struct bpf_iter_num* it)
 
 __bpf_kfunc void bpf_iter_num_destroy(struct bpf_iter_num *it)
 {
-	struct bpf_iter_num_kern *s = (void *)it;
-
-	s->cur = s->end = 0;
+	/*
+	 * Nothing to do: the stack slot backing the iterator is no longer
+	 * tracked as iterator state once destroy() returns, so its contents do
+	 * not matter. The verifier inlines this call away entirely.
+	 */
 }
 
 __bpf_kfunc_end_defs();
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 3a3d096f3966e..36f3e80d2f0b9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19838,6 +19838,18 @@ static int inline_bpf_iter_num_next(struct bpf_insn *insn_buf)
 	return i;
 }
 
+/*
+ * Inline bpf_iter_num_destroy(). The stack slot is no longer tracked as iterator state after
+ * destroy(), so nothing has to be done to it; emit a nop just to drop the call. Keep in sync
+ * with the kfunc in kernel/bpf/bpf_iter.c.
+ */
+static int inline_bpf_iter_num_destroy(struct bpf_insn *insn_buf)
+{
+	insn_buf[0] = BPF_JMP_A(0);
+
+	return 1;
+}
+
 int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 		     struct bpf_insn *insn_buf, int insn_idx, int *cnt)
 {
@@ -19971,6 +19983,8 @@ int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 		*cnt = inline_bpf_iter_num_new(insn_buf);
 	} else if (desc->func_id == special_kfunc_list[KF_bpf_iter_num_next]) {
 		*cnt = inline_bpf_iter_num_next(insn_buf);
+	} else if (desc->func_id == special_kfunc_list[KF_bpf_iter_num_destroy]) {
+		*cnt = inline_bpf_iter_num_destroy(insn_buf);
 	}
 
 	if (env->insn_aux_data[insn_idx].arg_prog) {
-- 
2.53.0-Meta