[GIT PULL] BPF fixes for 7.1-rc1

[GIT PULL] BPF fixes for 7.1-rc1

[Alexei Starovoitov]

Hi Linus,

The following changes since commit 1f5ffc672165ff851063a5fd044b727ab2517ae3:

  Fix mismerge of the arm64 / timer-core interrupt handling changes (2026-04-14 23:03:02 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to e1d486445af3c392628532229f7ce5f5cf7891b6:

  bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT (2026-04-17 12:05:45 -0700)

----------------------------------------------------------------
Most of the diff stat comes from Xu Kuohai's fix. Since all JITs
had to be touched to move constant blinding out and pass bpf_verifier_env in.

- Fix use-after-free in arena_vm_close on fork (Alexei Starovoitov)

- Dissociate struct_ops program with map if map_update fails (Amery Hung)

- Fix out-of-range and off-by-one bugs in arm64 JIT (Daniel Borkmann)

- Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel Borkmann)

- Fix arg tracking for imprecise/multi-offset in BPF_ST/STX insns
  (Eduard Zingerman)

- Copy token from main to subprogs to fix missing kallsyms (Eduard Zingerman)

- Prevent double close and leak of btf objects in libbpf (Jiri Olsa)

- Fix af_unix null-ptr-deref in sockmap (Michal Luczaj)

- Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta Yatsenko)

- Avoid unnecessary IPIs. Remove redundant bpf_flush_icache() in arm64 and
  riscv JITs (Puranjay Mohan)

- Fix out of bounds access. Validate node_id in arena_alloc_pages() (Puranjay Mohan)

- Reject BPF-to-BPF calls and callbacks in arm32 JIT (Puranjay Mohan)

- Refactor all JITs to pass bpf_verifier_env to emit ENDBR/BTI
  for indirect jump targets on x86-64, arm64 JITs (Xu Kuohai)

- Allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
----------------------------------------------------------------
Alexei Starovoitov (8):
      Merge branch 'bpf-arg-tracking-for-imprecise-multi-offset-bpf_st-stx'
      bpf: Fix use-after-free in arena_vm_close on fork
      Merge branch 'bpf-arm64-riscv-remove-redundant-icache-flush-after-pack-allocator-finalize'
      Merge branch 'fix-garbage-data-in-task-local-data'
      Merge branch 'bpf-copy-bpf-token-from-main-program-to-subprograms'
      Merge branch 'emit-endbr-bti-instructions-for-indirect'
      Merge branch 'bpf-fix-null-deref-when-storing-scalar-into-kptr-slot'
      Merge branch 'bpf-allow-utf-8-literals-in-bpf_bprintf_prepare'

Amery Hung (4):
      selftests/bpf: Prevent allocating data larger than a page
      selftests/bpf: Fix tld_get_data() returning garbage data
      selftests/bpf: Test small task local data allocation
      bpf: Dissociate struct_ops program with map if map_update fails

Daniel Borkmann (3):
      bpf, arm64: Reject out-of-range B.cond targets
      bpf, arm64: Fix off-by-one in check_imm signed range check
      bpf: Fix precedence bug in convert_bpf_ld_abs alignment check

Eduard Zingerman (4):
      bpf: fix arg tracking for imprecise/multi-offset BPF_ST/STX
      selftests/bpf: arg tracking for imprecise/multi-offset BPF_ST/STX
      bpf: copy BPF token from main program to subprograms
      selftests/bpf: verify kallsyms entries for token-loaded subprograms

Jiri Olsa (1):
      libbpf: Prevent double close and leak of btf objects

Martin KaFai Lau (1):
      Merge branch 'bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-update'

Michal Luczaj (5):
      bpf, sockmap: Annotate af_unix sock:: Sk_state data-races
      bpf, sockmap: Fix af_unix iter deadlock
      selftests/bpf: Extend bpf_iter_unix to attempt deadlocking
      bpf, sockmap: Fix af_unix null-ptr-deref in proto update
      bpf, sockmap: Take state lock for af_unix iter

Mykyta Yatsenko (2):
      bpf: Fix NULL deref in map_kptr_match_type for scalar regs
      selftests/bpf: Reject scalar store into kptr slot

Puranjay Mohan (4):
      bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator finalize
      bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize
      bpf: Validate node_id in arena_alloc_pages()
      bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT

Shung-Hsi Yu (1):
      selftests/bpf: Fix timer_start_deadlock failure due to hrtimer change

Xu Kuohai (5):
      bpf: Move constants blinding out of arch-specific JITs
      bpf: Pass bpf_verifier_env to JIT
      bpf: Add helper to detect indirect jump targets
      bpf, x86: Emit ENDBR for indirect jump targets
      bpf, arm64: Emit BTI for indirect jump target

Yihan Ding (2):
      bpf: allow UTF-8 literals in bpf_bprintf_prepare()
      selftests/bpf: cover UTF-8 trace_printk output

 arch/arc/net/bpf_jit_core.c                        |  41 ++---
 arch/arm/net/bpf_jit_32.c                          |  49 ++----
 arch/arm64/lib/insn.c                              |   2 +
 arch/arm64/net/bpf_jit_comp.c                      | 103 ++++-------
 arch/loongarch/net/bpf_jit.c                       |  61 ++-----
 arch/mips/net/bpf_jit_comp.c                       |  22 +--
 arch/parisc/net/bpf_jit_core.c                     |  75 ++++----
 arch/powerpc/net/bpf_jit_comp.c                    |  74 +++-----
 arch/riscv/net/bpf_jit.h                           |   6 -
 arch/riscv/net/bpf_jit_core.c                      |  70 +++-----
 arch/s390/net/bpf_jit_comp.c                       |  61 +++----
 arch/sparc/net/bpf_jit_comp_64.c                   |  63 +++----
 arch/x86/net/bpf_jit_comp.c                        |  73 +++-----
 arch/x86/net/bpf_jit_comp32.c                      |  35 +---
 include/linux/bpf.h                                |   2 +
 include/linux/bpf_verifier.h                       |   9 +-
 include/linux/filter.h                             |  50 +++++-
 kernel/bpf/arena.c                                 |  23 ++-
 kernel/bpf/bpf_struct_ops.c                        |   7 +-
 kernel/bpf/core.c                                  | 138 ++++++++++-----
 kernel/bpf/fixups.c                                | 163 ++++++++++++++---
 kernel/bpf/helpers.c                               |  17 +-
 kernel/bpf/liveness.c                              | 114 ++++++------
 kernel/bpf/syscall.c                               |   4 -
 kernel/bpf/verifier.c                              |  26 ++-
 net/core/filter.c                                  |   2 +-
 net/core/sock_map.c                                |   4 +-
 net/unix/af_unix.c                                 |   9 +-
 net/unix/unix_bpf.c                                |   3 +
 tools/lib/bpf/libbpf.c                             |  21 +--
 tools/testing/selftests/bpf/Makefile               |   1 +
 tools/testing/selftests/bpf/prog_tests/snprintf.c  |   3 +-
 .../selftests/bpf/prog_tests/task_local_data.h     |  13 +-
 .../bpf/prog_tests/test_task_local_data.c          |  96 +++++++++-
 tools/testing/selftests/bpf/prog_tests/token.c     |  86 ++++++++-
 .../selftests/bpf/prog_tests/trace_printk.c        |  28 ++-
 .../selftests/bpf/prog_tests/unpriv_bpf_disabled.c |  21 +--
 tools/testing/selftests/bpf/progs/bpf_iter_unix.c  |  10 ++
 tools/testing/selftests/bpf/progs/map_kptr_fail.c  |  15 ++
 .../selftests/bpf/progs/task_local_data.bpf.h      |   5 +-
 .../selftests/bpf/progs/timer_start_deadlock.c     |   8 +-
 tools/testing/selftests/bpf/progs/token_kallsyms.c |  19 ++
 tools/testing/selftests/bpf/progs/trace_printk.c   |  10 ++
 .../selftests/bpf/progs/verifier_live_stack.c      | 193 +++++++++++++++++++++
 tools/testing/selftests/bpf/sysctl_helpers.c       |  37 ++++
 tools/testing/selftests/bpf/sysctl_helpers.h       |   8 +
 46 files changed, 1173 insertions(+), 707 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/token_kallsyms.c
 create mode 100644 tools/testing/selftests/bpf/sysctl_helpers.c
 create mode 100644 tools/testing/selftests/bpf/sysctl_helpers.h

Re: [GIT PULL] BPF fixes for 7.1-rc1

[pr-tracker-bot]

The pull request you sent on Fri, 17 Apr 2026 12:26:27 -0700:

> https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/eb0d6d97c27c29cd7392c8fd74f46edf7dff7ec2

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

Re: [GIT PULL] BPF fixes for 7.1-rc1

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to bpf/bpf.git (master)
by Linus Torvalds <torvalds@linux-foundation.org>:

On Fri, 17 Apr 2026 12:26:27 -0700 you wrote:
> Hi Linus,
> 
> The following changes since commit 1f5ffc672165ff851063a5fd044b727ab2517ae3:
> 
>   Fix mismerge of the arm64 / timer-core interrupt handling changes (2026-04-14 23:03:02 -0700)
> 
> are available in the Git repository at:
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] BPF fixes for 7.1-rc1
    https://git.kernel.org/bpf/bpf/c/eb0d6d97c27c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html