[PATCH bpf-next v4 0/3] Follow ups for verifier errors set

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

Some follow up changes based on comments from Eduard, Sashiko, and BPF
CI Bot. See commits for details.

Patches 1-4 of v3 were applied to bpf-next. This is the remainder,
rebased on the current bpf-next/master.

Changelog:
----------
v3 -> v4
v3: https://lore.kernel.org/bpf/20260924170646.2366016-1-memxor@gmail.com

 * Drop v3 patches 1-4, which are already applied.
 * Rebase on the current bpf-next/master.
 * State in the Program Structure patch that CO-RE relocations stay where
   c26e97721b17 put them and only func_info and line_info validation
   moves ahead of the layout checks. (Alexei)

v2 -> v3
v2: https://lore.kernel.org/bpf/20260924092941.3174809-1-memxor@gmail.com

 * Rebase on bpf-next/master, which now applies CO-RE relocations before
   subprogram discovery, and only move func_info and line_info validation
   ahead of the layout checks.
 * Drop the truncated final LD_IMM64 relocation guard and its test, as
   bpf_check() now rejects that form up front and core_reloc_raw covers it.

v1 -> v2
v1: https://lore.kernel.org/bpf/20260816015746.2632990-1-memxor@gmail.com

 * Drop v1 patches 3, 5-7, 11, and 13-14 because they are already present
   in bpf-next.
 * Use instruction-neutral wording for variable-offset stack accesses
   rather than inferring an atomic operation from value_regno == -1. (Eduard)
 * Update the variable-offset assertions and cover the retained
   uninitialized stack-read diagnostic through the existing CAP_PERFMON-less
   read inside the allocated stack. (BPF CI)
 * Keep v1 patch 4 unchanged after confirming that the write filter is
   reachable for lineage-preserving ALU operations with unchanged
   diagnostic snapshots; only its spill arm is impossible. Say so in the
   commit message. (Eduard)
 * Consider active critical sections only for sleepable programs and let
   non-sleepable programs reach the existing no-active-context fallback
   instead of adding an early branch. A non-sleepable program can still
   hold RCU, preempt, IRQ, or lock state, so the fallback alone would
   keep blaming the region. Keep the "non-sleepable prog" description.
   (Eduard, BPF CI)
 * Select the helper and global-function suggestions by cause, matching
   the kfunc site. (BPF CI)
 * Split the kfunc coverage into a non-sleepable program case and a
   sleepable program inside an RCU read-side critical section. (Eduard)
 * Scan subprogram properties with nested loops and drop the partial
   recursive-edge details together with their assertion. (Eduard)
 * Reject CO-RE relocations targeting a truncated final LD_IMM64 before
   applying them, since BTF validation now runs before the subprogram
   layout check, and add raw CO-RE coverage for the rejection. Add the
   Fixes tag. (BPF CI)
 * Rebase on the current bpf-next/master and let the new property scan
   also set the callx marker that check_subprogs() collects upstream.

Kumar Kartikeya Dwivedi (3):
  selftests/bpf: Test non-sleepable kfunc context
  bpf: Correct Program Structure diagnostic context
  selftests/bpf: Test Program Structure diagnostic context

 kernel/bpf/cfg.c                              |  2 +-
 kernel/bpf/verifier.c                         | 54 +++++++++++++------
 .../selftests/bpf/progs/preempt_lock.c        | 26 +++++++++
 .../selftests/bpf/progs/verifier_cfg.c        | 40 ++++++++++++++
 .../selftests/bpf/progs/verifier_gotox.c      |  2 +
 5 files changed, 106 insertions(+), 18 deletions(-)


base-commit: ea9358e1270ab2c3ba6f36bd9bdda68617665516
-- 
2.53.0