[PATCH bpf-next v4 00/12] bpf: Allow arena pointers in by-value returns

[Yonghong Song <yonghong.song@linux.dev>]

A function returning a struct by value may only return one whose members
are all scalars. That is stricter than it needs to be: an arena pointer
is safe to hand over as raw register bits, and both a global function
and a kfunc can already return one on its own.

This patch set allows returning arena pointer(s) (as member(s) of a
struct) for global functions and kfuncs. Any other pointer member stays
rejected, as it would be laundered into a scalar and escape provenance
and reference tracking.

Patch 1 fixes a diagnostics bug. Patches 2-4 are refactoring with no
functional change. Patch 5 checked (nested) arrays until non-array type
to be checked by struct or other types. Patch 6 improves the diagnostics
for an unsupported return type, and patches 7-8 allow arena pointer members.
Patches 9-11 are selftests. Patch 12 updates the kfunc's doc.

Changelog:
  v3 -> v4:
    - v3: https://lore.kernel.org/bpf/20260827061114.2514603-1-yonghong.song@linux.dev/
    - Generate type string(s) for those verifier rejected kfunc's.
    - For global function, disable returning arena pointer if main prog.
    - Add additional tests for rejected kfunc type string(s).
  v2 -> v3:
    - v2: https://lore.kernel.org/bpf/20260825205412.1320099-1-yonghong.song@linux.dev/
    - Fix two more verifier diagnostics.
    - Fix btf_member_path_str() by detecting anonymous union/struct.
    - Fix a few arena tests with non-zero arena pointers.
    - Update kfuncs doc for supporting return value with arena pointers.
  v1 -> v2:
    - v1: https://lore.kernel.org/bpf/20260824144943.991316-1-yonghong.song@linux.dev/
    - Add nested struct field names for diagnostics, and report the
      nesting depth for a type nested past the walk limit.
    - Allow to return arena pointers for global functions and kfuncs.
    - Necessary selftests for newly supported arena pointers.

Yonghong Song (12):
  bpf: Record each half of a paired return value in verifier diagnostics
  bpf: Drop the recursion depth argument of btf_type_is_scalar_struct()
  bpf: Add btf_type_is_arena_ptr()
  bpf: Let the by-value struct walk take the kinds of member it accepts
  bpf: Let a by-value struct nest arrays and structs freely
  bpf: Report which member makes a kfunc return type unsupported
  bpf: Allow a global function to return arena pointers by value
  bpf: Allow arena pointers in a by-value kfunc return
  selftests/bpf: Check the member named for an unsupported kfunc return
    type
  selftests/bpf: Test global functions returning arena pointers by value
  selftests/bpf: Test kfuncs returning arena pointers by value
  docs/bpf: Document arena pointers in a by-value return

 Documentation/bpf/kfuncs.rst                  |  39 +--
 include/linux/bpf_verifier.h                  |  11 +-
 include/linux/btf.h                           |   1 +
 kernel/bpf/btf.c                              |  90 ++++---
 kernel/bpf/verifier.c                         | 228 ++++++++++++++----
 .../selftests/bpf/prog_tests/aggregate_ret.c  |  42 ++++
 .../selftests/bpf/progs/aggregate_ret_func.c  | 146 +++++++++++
 .../selftests/bpf/progs/aggregate_ret_kfunc.c |  84 ++++++-
 .../bpf/progs/aggregate_ret_kfunc_arena.c     | 121 ++++++++++
 .../selftests/bpf/progs/exceptions_fail.c     |   2 +-
 .../selftests/bpf/progs/verifier_arena.c      |  48 ++++
 .../selftests/bpf/test_kmods/bpf_testmod.c    |  72 ++++++
 .../bpf/test_kmods/bpf_testmod_kfunc.h        |  72 ++++++
 13 files changed, 850 insertions(+), 106 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/aggregate_ret_kfunc_arena.c

-- 
2.53.0-Meta