[PATCH bpf-next v6 0/9] Introduce arena library and runtime

Emil Tsalapatis
2026-04-12T01:19:01Z

Add a new subdirectory to tools/testing/selftests/bpf called libarena,
along with programs useful for writing arena-based BPF code. This
patchset adds the following:

1) libarena, a subdirectory where arena BPF code that is generally useful
to BPF arena programs can be easily added and tested.

2) An ASAN runtime for BPF arena programs. BPF arenas allow for accessing
memory after it has been freed or if it is out of bounds, making it more
difficult to triage bugs combined to regular BPF. Use LLVM's recently added
support for address-space based sanitization to selectively sanitize just
the arena accesses.

3) A buddy memory allocator that can be reused by BPF programs to handle
memory allocation/deletion. The allocator uses the ASAN runtime to add
address sanitization if requested.

The patch includes testing for the new allocators and ASAN features that
can be built from the top directory using "make libarena_test" and
"make libarena_test_asan". The generated binaries reside in libarena/.
The patch also adds test-progs-based selftests to the codebase for the
libarena code, so the new tests are run by ./test_progs.

The patchset has the following stucture:

1-2: Addresses a verification failure triggered by SCALAR += PTR_TO_ARENA
instructions.

3-4: Minor changes to selftest headers to prepare for the introduction
of libarena.

5-7: Add the libarena directory and testing scaffolding, and introduce
the ASAN runtime.

8-9: Add the new buddy memory allocator along with self-contained and
prog-tests-based selftests.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>

HISTORY
=======

v5->v6 (https://lore.kernel.org/bpf/20260410163041.8063-1-emil@etsalapatis.com)
- Fix subreg_def management for SCALAR += PTR_TO_ARENA operations (AI)
- Add more selftests for the SCALAR += PTR_TO_ARENA patch (Sashiko)
- Adjust fls() operation to be in line with the kernel version (Sashiko)
- Address Sashiko selftests and debugging nits
- Add ASAN loadN and storeN _noabort variants and associated BTF anchor
- Remove unnecessary bit freeing of buddies during block splitting

v4->v5 (https://lore.kernel.org/bpf/20260407045730.13359-1-emil@etsalapatis.com)
Omitting various nits and fixups.
- Properly adjust subreg_def for scalar += ptr_to_arena calls (Sashiko)
- Remove extraneous definition from prog_tests/arena_spin_lock.c (Song)
- Trim extraneous comments from ASAN and buddy (Alexei)
- Remove asan_dummy call and replace with function pointer array (Alexei)
- Remove usersapi.h header and merge it into common.h (Alexei)
- Replace ASAN macros with function calls (Alexei)
- Embed buddy lock into the struct and move the buddy allocator to __arena_global
(Alexei)
- Add commenting for buddy allocator constants (Alexei)
- Add default buddy allocator directly in common.bpf.c, so that the user does
not need to define it.
- Expand test harnesses to dynamically find individual selftests. Now the
selftests also reports each test individually (e.g., 5 entries for the
buddy allocator instead of 1). This brings them to par with the rest of
the test_progs.

v3->v4 (https://lore.kernel.org/bpf/20260403042720.18862-1-emil@etsalapatis.com)
- Add Acks by Song to patches 1-4.
- Expand the verifier's handling of scalar/arena operations to
include all 3-operand operations in Patch 1 (Alexei)
- Add additional tests for arena/arena (allowed) and arena/pointer (not allowed)
operations in Patch 2
- Remove ASAN version of the library from default compilation since it requires
LLVM 22 and up (CI)
- Rework buddy allocator locking for clarity and add comments
- Fix From: email to be consistent with SOB
- Address (most) Sashiko comments

v2->v3 (https://lore.kernel.org/bpf/20260127181610.86376-1-emil@etsalapatis.com)
Nonexhaustive due to significant patch rework.
- Do not duplicate WRITE_ONCE macro (Mykyta, Kumar)
- Add SPDX headers (Alexei)
- Remove bump/stack allocators (Alexei)
- Integrate testing with test_progs (Kumar)
- Add short description of ASAN algorithm at the top of the file (Alexei)

v1->v2 (https://lore.kernel.org/bpf/20260122160131.2238331-1-etsal@meta.com/)

- Added missing format string argument (AI)
- Fix outdated selftests prog name check (AI)
- Fixed stack allocation check for segment creation (AI)
- Fix errors in non-ASAN bump allocator selftests (AI)
- Propagate error value from individual selftests in selftest.c
- Removed embedded metadata from bump allocator as it was needlessly
complicating its behavior

Emil Tsalapatis (9):
bpf: Upgrade scalar to PTR_TO_ARENA on arena pointer addition
selftests/bpf: Add test for scalar/arena pointer addition
selftests/bpf: Move bpf_arena_spin_lock.h to the top level
selftests/bpf: Deduplicate WRITE_ONCE macro between headers
selftests/bpf: Add basic libarena scaffolding
selftests/bpf: Add arena ASAN runtime to libarena
selftests/bpf: Add ASAN support for libarena selftests
selftests/bpf: Add buddy allocator for libarena
selftests/bpf: Add selftests for libarena buddy allocator

kernel/bpf/verifier.c | 73 +-
tools/testing/selftests/bpf/.gitignore | 2 +
tools/testing/selftests/bpf/Makefile | 28 +-
.../testing/selftests/bpf/bpf_arena_common.h | 4 -
.../bpf/{progs => }/bpf_arena_spin_lock.h | 4 +-
tools/testing/selftests/bpf/bpf_atomic.h | 4 -
.../testing/selftests/bpf/bpf_experimental.h | 3 +
tools/testing/selftests/bpf/libarena/Makefile | 77 ++
.../selftests/bpf/libarena/include/asan.h | 118 +++
.../selftests/bpf/libarena/include/buddy.h | 92 ++
.../selftests/bpf/libarena/include/common.h | 68 ++
.../bpf/libarena/include/selftest_helpers.h | 121 +++
.../bpf/libarena/selftests/selftest.c | 188 ++++
.../libarena/selftests/st_asan_buddy.bpf.c | 243 +++++
.../bpf/libarena/selftests/st_asan_common.h | 47 +
.../bpf/libarena/selftests/st_buddy.bpf.c | 211 ++++
.../selftests/bpf/libarena/src/asan.bpf.c | 559 +++++++++++
.../selftests/bpf/libarena/src/buddy.bpf.c | 903 ++++++++++++++++++
.../selftests/bpf/libarena/src/common.bpf.c | 74 ++
.../bpf/prog_tests/arena_spin_lock.c | 7 -
.../selftests/bpf/prog_tests/libarena.c | 62 ++
.../selftests/bpf/progs/arena_spin_lock.c | 2 +-
.../selftests/bpf/progs/verifier_arena.c | 127 +++
23 files changed, 2984 insertions(+), 33 deletions(-)
rename tools/testing/selftests/bpf/{progs => }/bpf_arena_spin_lock.h (99%)
create mode 100644 tools/testing/selftests/bpf/libarena/Makefile
create mode 100644 tools/testing/selftests/bpf/libarena/include/asan.h
create mode 100644 tools/testing/selftests/bpf/libarena/include/buddy.h
create mode 100644 tools/testing/selftests/bpf/libarena/include/common.h
create mode 100644 tools/testing/selftests/bpf/libarena/include/selftest_helpers.h
create mode 100644 tools/testing/selftests/bpf/libarena/selftests/selftest.c
create mode 100644 tools/testing/selftests/bpf/libarena/selftests/st_asan_buddy.bpf.c
create mode 100644 tools/testing/selftests/bpf/libarena/selftests/st_asan_common.h
create mode 100644 tools/testing/selftests/bpf/libarena/selftests/st_buddy.bpf.c
create mode 100644 tools/testing/selftests/bpf/libarena/src/asan.bpf.c
create mode 100644 tools/testing/selftests/bpf/libarena/src/buddy.bpf.c
create mode 100644 tools/testing/selftests/bpf/libarena/src/common.bpf.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/libarena.c

--
2.53.0