Re: [PATCH bpf-next v3 1/6] bpf: Add KF_ACQUIRE and KF_RELEASE support for iterators

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2026-02-23 at 09:46 -0800, Puranjay Mohan wrote:

[...]

> @@ -1083,6 +1084,23 @@ static int mark_stack_slots_iter(struct bpf_verifier_env *env,
>  	return 0;
>  }
>  
> +/*
> + * Release the acquired reference tracked by iter_st->id, if any.
> + * Used during auto-release in _next, DRAINED handling, and _destroy.
> + */
> +static int iter_release_acquired_ref(struct bpf_verifier_env *env,
> +				     struct bpf_reg_state *iter_st)
> +{
> +	int err;
> +
> +	if (!iter_st->id)
> +		return 0;
> +	err = release_reference(env, iter_st->id);
> +	if (!err)
> +		iter_st->id = 0;

Nit: maybe drop the `!err` check?
     It requires a few moments to process mentally and the verifier
     should stop on this error anyway.

> +	return err;
> +}
> +
>  static int unmark_stack_slots_iter(struct bpf_verifier_env *env,
>  				   struct bpf_reg_state *reg, int nr_slots)
>  {

[...]

> @@ -9178,8 +9204,11 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx,
>  	/* mark current iter state as drained and assume returned NULL */
>  	cur_iter->iter.state = BPF_ITER_STATE_DRAINED;
>  	__mark_reg_const_zero(env, &cur_fr->regs[BPF_REG_0]);
> -
> -	return 0;
> +	/*
> +	 * If _next acquired a ref (KF_ACQUIRE), release it in the DRAINED branch since NULL
> +	 * was returned.
> +	 */
> +	return iter_release_acquired_ref(env, cur_iter);

Nit: Check that `_next` is KF_ACQUIRE here?
     Not strictly needed for this patch but is a bit more consistent.
     E.g. consider some future iterator that acquires reference on creation
     and not on `_next`.

>  }
>  
>  static bool arg_type_is_mem_size(enum bpf_arg_type type)
> @@ -14197,6 +14226,17 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>  
>  		if (meta.initialized_dynptr.ref_obj_id) {
>  			err = unmark_stack_slots_dynptr(env, reg);
> +		} else if (base_type(reg->type) == PTR_TO_STACK) {
> +			struct bpf_reg_state *iter_st;
> +
> +			iter_st = get_iter_from_state(env->cur_state, &meta);
> +			if (!iter_st->id) {
> +				verbose(env, "no acquired reference to release\n");
> +				return -EINVAL;
> +			}
> +			err = release_reference(env, iter_st->id);
> +			if (!err)
> +				iter_st->id = 0;

Nit: iter_release_acquired_ref()?

>  		} else {
>  			err = release_reference(env, reg->ref_obj_id);
>  			if (err)

[...]