Merge branch 'bpf-track-borrowed-iterator-result-lifetimes'

Xu Yunxiang says:

====================
bpf: Track borrowed iterator result lifetimes

Make non-RCU, non-acquired struct iterator results borrow the current
element lifetime by default. KF_ITER_RET_INDEPENDENT marks the explicit
exception for results whose lifetime is independent of the iterator.

Trusted field loads and dynptr constructors propagate the source lifetime
so derived pointers stay in the invalidation graph. Next preserves the
iterator itself and invalidates old dependents before both return
outcomes; destroy propagates outstanding-child errors.

This revision addresses Alexei's implementation review. Share the pointer
invalidation traversal through invalidate_reference(), with root reference
release performed separately by release_reference(). Iterator next calls
invalidation directly. The existing result classification already keeps
MEM_RCU results out of the iterator dependency graph, so the duplicate
RCU checks at next are unnecessary. The traversal excludes STACK_ITER,
so it also needs no special guard for the iterator's own stack identity.

Patch 1 retains the generic trusted-field rule and its file/inode lifetime
explanation. Patch 2 retains the iterator lifetime tests and the VFS
before-release and after-release controls unchanged.

Justin has coordinated the overlapping work and dropped the iterator
and acquired-parent trusted-field fixes from his v3 series. This series
keeps those fixes; his series covers RCU-parent field classification and
the __derives_ret kfunc argument annotation, including bpf_real_data_inode().
The two series are based independently on bpf-next. They overlap at
reg_lifetime_id() and the struct-return parent_id assignment and will need
those sites reconciled when combined.

Changes in v8:
  - Remove the duplicate RCU checks before iterator-next invalidation.
  - Separate pointer invalidation from root reference release, removing
    release_root and its unreachable root-alias guard. Keep the existing
    inline acquired-child leak check in the shared traversal.
  - Retain the test code and carry Amery's Reviewed-by tags from v7.
  - Rebase onto bpf-next 4169c9c90532 without changing either patch diff.
  - Remove the obsolete Assisted-by trailer for the current submission
    tooling; retain the AI-assistance disclosure in this cover.
  - Document the scope coordination with Justin and add him to Cc.

Changes in v7:
  - Explain the generic trusted-field lifetime rule and the file/inode
    example in patch 1's commit log, as requested by Alexei.
  - Add a positive and negative VFS test for that example in patch 2.
  - Rebase onto bpf-next b116ac6087541. The implementation's added and
    removed lines were unchanged from posted v6; the field-load hunk's
    context includes the upstream __nullable handling.

v7:
https://lore.kernel.org/r/20261021210754.3270023-1-xyx2021@mail.ustc.edu.cn
Alexei's v7 review:
https://lore.kernel.org/r/DMB212RCKZ56.LTNAJWB2D39T@gmail.com
v6:
https://lore.kernel.org/r/20260927120406.1041915-1-xyx2021@mail.ustc.edu.cn
Alexei's v6 review:
https://lore.kernel.org/r/DMA2SZ5PRG4N.3I51MHSTWUUTS@gmail.com
Justin's scope-coordination reply:
https://lore.kernel.org/r/att73Z9XpompG3k1@zenbox
Justin's v3:
https://lore.kernel.org/r/20261023212041.884996-1-utilityemal77@gmail.com
Kumar's related work:
https://lore.kernel.org/r/DLGYPZAL708V.3GFLANAPH2L8O@gmail.com

These lifetime paths were investigated through AI-assisted source
inspection and annotated verifier programs. The regressions check loading
and diagnostics. The independent-lifetime control uses a small bpf_testmod
iterator; the VFS control uses existing kfuncs. No delay or fault injection
is used to force runtime reclamation.

Validation on this candidate with a matching bpf_testmod:
  - W=1 verifier, full kernel and modules builds passed.
  - Changed BPF objects and required fixture compiled strictly.
  - iters: 1/122 passed; 0 skipped.
  - dynptr: 2/137 passed; 0 skipped.
  - file_reader: 1/10 passed; 0 skipped.
  - verifier_vfs_accept: 1/7 passed; 0 skipped.
  - verifier_vfs_reject: 1/13 passed; 0 skipped.
  - kmem_cache_iter: 1/3 passed; 0 skipped.
  - dmabuf_iter: 1/4 passed; 0 skipped.
  - verifier_ref_tracking: 1/57 passed; 0 skipped.
  - task_kfunc: 1/47 passed; 0 skipped.

The before-release VFS program loaded on both the unmodified
baseline and this candidate. The after-release program loaded on the
baseline and was rejected by this candidate with the expected scalar
access diagnostic. These annotated programs are load-only.

The VMs used panic_on_warn and panic_on_oops. No WARN_ON report,
Oops or panic was found. Unprivileged BPF was enabled only in the
isolated guests.

The complete test_progs build used BPF_STRICT_BUILD=1. The unfiltered
full suite, sanitizer and architecture matrices were not run. The
fresh baseline comparison covers the VFS example retained from v7.

Please queue the verifier fix for stable after it reaches the BPF tree.
====================

Link: https://patch.msgid.link/20261024100647.2579244-1-xyx2021@mail.ustc.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 1 insertions, 0 deletions

diff --git a/include/linux/btf.h b/include/linux/btf.h
index b66e20a18c54..a18254b7521b 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -82,6 +82,7 @@
 #define KF_IMPLICIT_ARGS (1 << 16) /* kfunc has implicit arguments supplied by the verifier */
 #define KF_SPINLOCK_SAFE (1 << 17) /* kfunc is allowed inside bpf_spin_lock-ed region */
 #define KF_PERFMON      (1 << 18) /* kfunc requires CAP_PERFMON */
+#define KF_ITER_RET_INDEPENDENT (1 << 19) /* next result outlives the current element */
 
 /*
  * Tag marking a kernel function as a kfunc. This is meant to minimize the