Re: [PATCH] bpf: make css iterator stay drained after NULL

[Tejun Heo <tj@kernel.org>]

On Tue, Nov 10, 2026 at 08:51:10PM +0800, Kang Chen wrote:
> The css_next_*() helpers start from @start when given a NULL position.
> bpf_iter_css_next() leaves kit->pos == NULL after the last element, but
> keeps kit->start set, so a next() call after exhaustion starts the
> iteration over from @start again.
>
> The verifier relies on the iterator contract that once next() returns
> NULL it keeps returning NULL: process_iter_next_call() marks the
> iterator DRAINED and treats the result of later next() calls as the
> constant zero.  A restarted css iteration therefore hands the BPF
> program a kernel pointer while the verifier believes R0 == 0.
>
> Clear kit->start when the position becomes NULL.  bpf_iter_css_destroy()
> is a no-op, so no cleanup depends on @start after exhaustion.
>
> Fixes: 7251d0905e75 ("bpf: Introduce css open-coded iterator kfuncs")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>

Acked-by: Tejun Heo <tj@kernel.org>

BPF folks, how do you want to route this? It can go through the bpf
tree or I can take it through cgroup/for-7.4-fixes.

Thanks.

--
tejun