Re: [PATCH bpf v3 1/2] bpf: Invalidate iterator-owned BTF pointers on next and destroy

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Fri Sep 11, 2026 at 1:42 AM PDT, Xu Yunxiang wrote:
> Open-coded iterator next kfuncs that return non-struct pointers associate
> the returned PTR_TO_MEM with the iterator's reference ID. Struct pointer
> returns take a separate PTR_TO_BTF_ID path which omits this relationship.
>
> This leaves such pointers verifier-valid after their lifetime ends. The
> task_vma iterator resets its VMA snapshot and drops the previous vm_file
> reference when next advances, then frees the snapshot on destroy. Other
> non-RCU struct iterators also release or replace their previous element on
> advance.
>
> A trusted field derived from an iterator result can also back a
> resource-tracked object. In particular, bpf_dynptr_from_file() does not
> take its own file reference. Losing vm_file's iterator parent while
> constructing a FILE dynptr therefore lets the dynptr outlive the snapshot's
> file reference.
>
> Associate non-RCU PTR_TO_BTF_ID results with the iterator reference. Before
> modeling another next result, invalidate older BTF pointers carrying that
> parent. Do this before constructing R0 and for both the ACTIVE and DRAINED
> iterator branches. The existing iterator reference release invalidates the
> current result on destroy.
>
> Preserve the parent across BTF field loads when the result remains fully
> trusted and its lifetime is tied to the parent. Do not propagate it to
> MEM_RCU, MEM_PERCPU, MEM_USER, or untrusted results, whose lifetime or
> access domain follows separate rules.
>
> When bpf_dynptr_from_file() consumes a borrowed file carrying such a
> parent, use that parent as the FILE dynptr's lifetime anchor. Reject
> iterator next or destroy while a resource child remains live, requiring
> the program to discard the dynptr before its backing file can be released.
>
> This issue was found during BPF verifier testing with an in-house runtime
> semantic checker.
>
> Fixes: 4cbee026db54 ("bpf: return VMA snapshot from task_vma iterator")
> Suggested-by: Amery Hung <ameryhung@gmail.com>

Amery,
is this really what you meant?
pls review.