BPF List
 help / color / mirror / Atom feed
* [PATCH bpf v3 0/2] bpf: Track iterator-owned BTF pointer lifetime
@ 2026-09-11  8:42 Xu Yunxiang
  2026-09-11  8:42 ` [PATCH bpf v3 1/2] bpf: Invalidate iterator-owned BTF pointers on next and destroy Xu Yunxiang
  2026-09-11  8:42 ` [PATCH bpf v3 2/2] selftests/bpf: Test iterator BTF pointer lifetimes Xu Yunxiang
  0 siblings, 2 replies; 4+ messages in thread
From: Xu Yunxiang @ 2026-09-11  8:42 UTC (permalink / raw)
  To: bpf
  Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Eduard Zingerman, Kumar Kartikeya Dwivedi, Amery Hung,
	Yonghong Song, Puranjay Mohan

bpf_iter_task_vma_next() returns a pointer to an iterator-owned VMA
snapshot. The next call resets that snapshot and drops the previous
snapshot's vm_file reference before filling it with another VMA. Destroying
the iterator frees the snapshot allocation. The verifier does not associate
the PTR_TO_BTF_ID result with either lifetime transition, so it permits old
direct and vm_file-derived pointers to remain usable.

Other non-RCU struct iterators also release or replace their previous
element when next advances. PTR_TO_MEM iterators already associate their
results with the iterator reference, but struct pointer returns take a
separate PTR_TO_BTF_ID path which omits this relationship.

Patch 1 associates non-RCU PTR_TO_BTF_ID next results with the iterator
reference. Before each next call creates a new result, it invalidates
older BTF pointers carrying that parent. Destroying the iterator uses the
existing reference-release path to invalidate the current result.
Pointer-valued BTF field loads preserve the parent only while the result
remains fully trusted and tied to its source; MEM_RCU, MEM_PERCPU, MEM_USER,
and untrusted fields retain their separate lifetime or access-domain rules.

A borrowed vm_file can also back a FILE dynptr, which does not take its own
file reference. Patch 1 carries the iterator lifetime anchor into that
dynptr and rejects next or destroy until the resource child is discarded.

Patch 2 adds task VMA verifier tests for destroy and for ACTIVE and DRAINED
next outcomes. It covers direct and vm_file-derived pointers, a FILE dynptr
across next and destroy, explicit dynptr discard, the current next result,
and independent MEM_RCU controls.

With the final 109-subtest payload, the baseline passes 102 expected
subtests while seven expected-failure programs load. V2 passes 104 while
five load. The final v3 passes all 109. The current-result, MEM_RCU, and
explicit-discard controls pass on every tested kernel.

The external triplet also behaves as expected on final v3: FRESH is
accepted and executes, STALE is rejected, and destroy-then-reacquire is
accepted and executes. Each probe invocation exits zero.

The issue is reachable by privileged BPF programs. This series is submitted
as a verifier correctness fix.

Please queue the verifier fix for stable after it reaches the BPF tree.

Tests:
  - W=1 make O=<build> kernel/bpf/verifier.o
  - make O=<build> -j12 bzImage modules
  - strict clang-20 build of iters_testmod.bpf.o
  - test_progs -t iters -v --watchdog-timeout 180 --workers=1
  - baseline/v2/v3 verifier differential
  - external live, stale, and destroy-then-reacquire load/test-run
    differential on final v3

The full unfiltered BPF selftest suite was not run.

Changes in v3:
  - Invalidate the previous non-RCU BTF result and its trusted descendants
    before modeling every next outcome, as raised in review of v2.
  - Carry a borrowed vm_file lifetime into FILE dynptr ancestry and reject
    iterator transitions until the dynptr is discarded.
  - Add separate ACTIVE and DRAINED next-call stale-pointer tests, with
    complete iterator cleanup on otherwise valid paths.
  - Add FILE dynptr next/destroy failures and an explicit-discard control.
  - Add current-result and across-next MEM_RCU controls.
  - Rebase from 15e2565f1c43 to e4a62833adff.

v2: https://lore.kernel.org/r/20260910044021.2279628-1-xyx2021@mail.ustc.edu.cn
v1: https://lore.kernel.org/r/20260909042907.1734153-1-xyx2021@mail.ustc.edu.cn

Xu Yunxiang (2):
  bpf: Invalidate iterator-owned BTF pointers on next and destroy
  selftests/bpf: Test iterator BTF pointer lifetimes

 include/linux/bpf_verifier.h                  |   6 +-
 kernel/bpf/verifier.c                         | 110 ++++--
 .../selftests/bpf/progs/iters_testmod.c       | 332 ++++++++++++++++++
 3 files changed, 424 insertions(+), 24 deletions(-)


base-commit: e4a62833adff6ef0fe7c0b90393204fe3c26b5c5
-- 
2.43.0


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-12  3:34 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-11  8:42 [PATCH bpf v3 0/2] bpf: Track iterator-owned BTF pointer lifetime Xu Yunxiang
2026-09-11  8:42 ` [PATCH bpf v3 1/2] bpf: Invalidate iterator-owned BTF pointers on next and destroy Xu Yunxiang
2026-09-12  3:34   ` Alexei Starovoitov
2026-09-11  8:42 ` [PATCH bpf v3 2/2] selftests/bpf: Test iterator BTF pointer lifetimes Xu Yunxiang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox