linux/kernel/bpf
Linus Torvalds eb0d6d97c2 bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmnihOkACgkQ6rmadz2v
 bTqjQA/+K6R/teQRwVmP1GDrfBjz2TXUzCN1WQQLzbnJNR96Mzq72+aTWjza89BK
 yEUP379qiOeUfEyyV7DNfHh8hAclUAMKuvI3T3pshLQhpOS0+YcpfbakEZbos+My
 AzEGhGl2nhT7S5twHFznCpuSaLgqldHkdAy4BZIiFkOS5lPBX9CU++OAslFPM+f8
 R28JQYWuv2/b1mRsz8zDmQQXxwH/Rpz9hdJKcpm/kCYYBay3cAFV7ArFJfn+Y5se
 9I6mTwNQ+xtSxtsmR/lftlGo1Vv9ah6qM9gKwgju0SkNrS+9UBlNUSmTrJk1fz+d
 SxdppCrqxwHY3UVd62eF4fWWgusC+oMuKzTh6d+D/ZkKvnEjdAx5XQ7uUQyYhKil
 G12vvKWcHit0Qz9RAhqlEEZ+GIpFTtLql6aW7pRmQKE8/vmQwAD1HBqNqWYKjokW
 btlJ3fUOGu8VHtnYbI3FN6VsK8BU9t/xMny9Fys9X4KmtWBLsm4udmiorV9uC+w6
 xV2s+x+ahythTEzVICB6BlQotSRyMd9kR5qisJsetWk+7NBY0Bwn7C0kfVGepHh0
 WerFSYdSifTvBWQjXnvqmAX7YspmpZvevw8PCtoPq1xq5d1FrYu1K5GX/xzpy+pH
 p13afkbN7Mk6OwteFefD1B0ofug3V9sx3HBI72ENs1Z+hh1KdOQ=
 =79I2
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
 "Most of the diff stat comes from Xu Kuohai's fix to emit ENDBR/BTI,
  since all JITs had to be touched to move constant blinding out and
  pass bpf_verifier_env in.

   - Fix use-after-free in arena_vm_close on fork (Alexei Starovoitov)

   - Dissociate struct_ops program with map if map_update fails (Amery
     Hung)

   - Fix out-of-range and off-by-one bugs in arm64 JIT (Daniel Borkmann)

   - Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel
     Borkmann)

   - Fix arg tracking for imprecise/multi-offset in BPF_ST/STX insns
     (Eduard Zingerman)

   - Copy token from main to subprogs to fix missing kallsyms (Eduard
     Zingerman)

   - Prevent double close and leak of btf objects in libbpf (Jiri Olsa)

   - Fix af_unix null-ptr-deref in sockmap (Michal Luczaj)

   - Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta
     Yatsenko)

   - Avoid unnecessary IPIs. Remove redundant bpf_flush_icache() in
     arm64 and riscv JITs (Puranjay Mohan)

   - Fix out of bounds access. Validate node_id in arena_alloc_pages()
     (Puranjay Mohan)

   - Reject BPF-to-BPF calls and callbacks in arm32 JIT (Puranjay Mohan)

   - Refactor all JITs to pass bpf_verifier_env to emit ENDBR/BTI for
     indirect jump targets on x86-64, arm64 JITs (Xu Kuohai)

   - Allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (32 commits)
  bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
  bpf: Dissociate struct_ops program with map if map_update fails
  bpf: Validate node_id in arena_alloc_pages()
  libbpf: Prevent double close and leak of btf objects
  selftests/bpf: cover UTF-8 trace_printk output
  bpf: allow UTF-8 literals in bpf_bprintf_prepare()
  selftests/bpf: Reject scalar store into kptr slot
  bpf: Fix NULL deref in map_kptr_match_type for scalar regs
  bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
  bpf, arm64: Emit BTI for indirect jump target
  bpf, x86: Emit ENDBR for indirect jump targets
  bpf: Add helper to detect indirect jump targets
  bpf: Pass bpf_verifier_env to JIT
  bpf: Move constants blinding out of arch-specific JITs
  bpf, sockmap: Take state lock for af_unix iter
  bpf, sockmap: Fix af_unix null-ptr-deref in proto update
  selftests/bpf: Extend bpf_iter_unix to attempt deadlocking
  bpf, sockmap: Fix af_unix iter deadlock
  bpf, sockmap: Annotate af_unix sock:: Sk_state data-races
  selftests/bpf: verify kallsyms entries for token-loaded subprograms
  ...
2026-04-17 15:58:22 -07:00
..
preload
Kconfig
Makefile bpf: Move BTF checking logic into check_btf.c 2026-04-12 12:37:04 -07:00
arena.c bpf-fixes 2026-04-17 15:58:22 -07:00
arraymap.c bpf: Fix RCU stall in bpf_fd_array_map_clear() 2026-04-10 12:10:06 -07:00
backtrack.c bpf: Move backtracking logic to backtrack.c 2026-04-12 12:36:58 -07:00
bloom_filter.c
bpf_cgrp_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
bpf_inode_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
bpf_insn_array.c
bpf_iter.c
bpf_local_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
bpf_lru_list.c
bpf_lru_list.h
bpf_lsm.c bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks 2026-04-07 07:57:07 -07:00
bpf_lsm_proto.c
bpf_struct_ops.c bpf: Dissociate struct_ops program with map if map_update fails 2026-04-17 12:04:14 -07:00
bpf_task_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
btf.c btf: Support kernel parsing of BTF with layout info 2026-03-26 13:53:56 -07:00
btf_iter.c
btf_relocate.c
cfg.c bpf: Move check_cfg() into cfg.c 2026-04-12 12:36:45 -07:00
cgroup.c
cgroup_iter.c
check_btf.c bpf: Move BTF checking logic into check_btf.c 2026-04-12 12:37:04 -07:00
const_fold.c bpf: Add bpf_compute_const_regs() and bpf_prune_dead_branches() passes 2026-04-03 08:34:36 -07:00
core.c bpf: Add helper to detect indirect jump targets 2026-04-16 07:03:40 -07:00
cpumap.c
cpumask.c
crypto.c
devmap.c bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path 2026-03-24 15:17:20 -07:00
disasm.c
disasm.h
dispatcher.c
dmabuf_iter.c
fixups.c bpf: Add helper to detect indirect jump targets 2026-04-16 07:03:40 -07:00
hashtab.c Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test" 2026-04-12 13:36:55 -07:00
helpers.c bpf: allow UTF-8 literals in bpf_bprintf_prepare() 2026-04-16 15:53:32 -07:00
inode.c
kmem_cache_iter.c
link_iter.c
liveness.c bpf: fix arg tracking for imprecise/multi-offset BPF_ST/STX 2026-04-15 08:40:47 -07:00
local_storage.c bpf: fix end-of-list detection in cgroup_storage_get_next_key() 2026-04-05 18:45:05 -07:00
log.c bpf: poison dead stack slots 2026-04-10 15:13:38 -07:00
lpm_trie.c
map_in_map.c
map_in_map.h
map_iter.c
memalloc.c bpf: Retire rcu_trace_implies_rcu_gp() 2026-04-07 12:24:49 -07:00
mmap_unlock_work.h
mprog.c
net_namespace.c
offload.c bpf: Fix use-after-free in offloaded map/prog info fill 2026-04-09 13:24:32 -07:00
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
range_tree.c
range_tree.h
relo_core.c
reuseport_array.c
ringbuf.c
rqspinlock.c
rqspinlock.h
stackmap.c
states.c bpf: Move state equivalence logic to states.c 2026-04-12 12:36:52 -07:00
stream.c
syscall.c bpf: Pass bpf_verifier_env to JIT 2026-04-16 07:03:40 -07:00
sysfs_btf.c
task_iter.c bpf: return VMA snapshot from task_vma iterator 2026-04-10 12:05:16 -07:00
tcx.c
tnum.c bpf: Simplify tnum_step() 2026-03-24 08:45:29 -07:00
token.c
trampoline.c
verifier.c bpf: Fix NULL deref in map_kptr_match_type for scalar regs 2026-04-16 15:20:26 -07:00