BPF List
 help / color / mirror / Atom feed
* [PATCH v2 bpf 00/19] bpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks
@ 2026-10-27 19:02 Alexei Starovoitov
  2026-10-27 19:02 ` [PATCH v2 bpf 01/19] selftests/bpf: Remove tests for global data in arena Alexei Starovoitov
                   ` (19 more replies)
  0 siblings, 20 replies; 25+ messages in thread
From: Alexei Starovoitov @ 2026-10-27 19:02 UTC (permalink / raw)
  To: bpf; +Cc: daniel, andrii, eddyz87, memxor

From: Alexei Starovoitov <ast@kernel.org>

This series removes BPF_F_ARENA_SCALAR and fixes bugs in scalar evolution,
in maybe_fork_scalars() and in the trampoline of may_goto. The groups of
patches do not depend on each other.

v1 was Part 1 of "bpf: Stack in arena and a verifier that joins states"
[1]. Parts 2 and 3 of that series are not here.

 - Patches 1-6 remove BPF_F_ARENA_SCALAR, .arena.data and what came with
   them. The flag lets a prog access arena through plain numbers, for
   languages that have no address spaces. The compiler can emit one
   addr_space_cast for each pointer instead. That is cheaper than one more
   insn for each access. No released kernel has the flag.
 - Patches 7-8: scalar evolution does not clear 'delta' in a register that
   it widens. Then the verifier calculates an incorrect range for a linked
   register, and an unsafe prog loads.
 - Patches 9-10 make two selftests reliable: map_kptr and rcu_reentry.
 - Patches 11-12: scalar evolution widens a pointer to a buffer
   (PTR_TO_BUF). The verifier rejects an access to a buffer at a variable
   offset. Thus it rejects a correct loop over the per-cpu values of a map
   element.
 - Patches 13-15: two bugs in the clamp of scalar evolution. A pointer that
   the loop invalidates becomes a scalar with the range of the offsets of
   the pointer. A packet pointer keeps a range that is not valid for its
   new offsets. In the two cases an unsafe prog loads and crashes the
   kernel.
 - Patches 16-17: maybe_fork_scalars() splits a state in two and verifies
   the second state later, from the same insn. In a loop that scalar
   evolution counted, pruning drops the second state. Then no one verifies
   one of the two values, and a prog that reads out of bounds loads.
 - Patches 18-19: arch_bpf_timed_may_goto() does not save the registers in
   which the JITs pass stack arguments. After may_goto such an argument is
   not what the verifier knows about it. An unsafe prog crashes the kernel.

Tests on x86-64, compared with the same tests on the base:

  test_progs, test_progs-no_alu32, test_progs-cpuv4,   no new failure
  test_progs-bpf_gcc, test_verifier, test_maps
  test_progs with KASAN                                no new failure
  veristat, 36 weekly builds of Cilium, 5032 progs     same verdicts,
                                                       insns -0.03%
  veristat, sched-ext/scx, 563 progs                   same verdicts
  veristat, selftests from clang 21, clang 24 and GCC  see below

In the selftests the verdict changes only for the tests of this series and
for the tests of .arena.data. The change in Cilium is from patch 16. arm64
is compile tested.

v1 -> v2:
 - Rebase on the fixes for scalar evolution from Eduard.
 - Drop "bpf: One time slice of may_goto for a run of a prog" and its
   tests. The patch has bugs. The insns at the exit of a subprog change R2,
   which is a part of a 16-byte return value (Ihor). A nested run of the
   prog starts the time slice again. I will send it as a separate series.
 - Patch 7: use clear_scalar_id() (Daniel).
 - Drop "bpf: Fix a false verifier bug in the clamp of scalar evolution"
   and its tests. Commit 0c33d612bdd5 ("bpf: Do not intersect with current
   register range on clamp") fixes the bug in a better way (Eduard).
 - Patch 5: name the two schedulers in C that set the flag.
 - Patch 11: correct the reason why two selftests load today.
 - Add patches 10, 13-15 and 18-19.
 - Add patches 16-17. They were patch 46 and a part of patch 75 in v1. The
   bug is in the tree today (Ihor). The log in v1 said that no prog is
   affected. That was wrong.

[1] https://lore.kernel.org/bpf/20261026025943.404450-1-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Alexei Starovoitov (19):
  selftests/bpf: Remove tests for global data in arena
  libbpf: Remove .arena.data
  libbpf: Keep format strings of bpf_printk() in .rodata
  selftests/bpf: Remove tests for arena access through numbers
  bpf: Remove BPF_F_ARENA_SCALAR
  bpf, x86: Remove r0_on_stack from fetching atomics in arena
  bpf: Clear delta of a register that scalar evolution widens
  selftests/bpf: Test that a widened register is not linked
  selftests/bpf: Wait for the last maps of map_kptr to be freed
  selftests/bpf: Avoid a page fault in rcu_reentry while the handler is
    armed
  bpf: Don't widen a pointer to a buffer in scalar evolution
  selftests/bpf: Test a loop that moves a pointer to a buffer
  bpf: Don't clamp a register whose type changed in the loop
  bpf: Reset the range of a packet pointer that scalar evolution clamps
  selftests/bpf: Test the clamp of pointers in scalar evolution
  bpf: Finish the insn in the state that maybe_fork_scalars() splits off
  selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
  bpf: Keep stack arguments in arch_bpf_timed_may_goto()
  selftests/bpf: Test stack arguments across may_goto

 arch/arm64/net/bpf_jit_comp.c                 |    5 -
 arch/arm64/net/bpf_timed_may_goto.S           |   10 +-
 arch/riscv/net/bpf_timed_may_goto.S           |   27 +-
 arch/x86/net/bpf_jit_comp.c                   |   63 +-
 arch/x86/net/bpf_timed_may_goto.S             |    3 +
 include/linux/bpf_verifier.h                  |    8 +-
 include/linux/filter.h                        |    1 -
 include/uapi/linux/bpf.h                      |    6 -
 kernel/bpf/core.c                             |    9 +-
 kernel/bpf/fixups.c                           |   39 -
 kernel/bpf/scev.c                             |   18 +-
 kernel/bpf/syscall.c                          |    4 -
 kernel/bpf/verifier.c                         |   97 +-
 tools/include/uapi/linux/bpf.h                |    6 -
 tools/lib/bpf/bpf_helpers.h                   |   18 +-
 tools/lib/bpf/libbpf.c                        |  433 +-----
 tools/testing/selftests/bpf/Makefile          |   12 +-
 .../testing/selftests/bpf/Makefile.buildvars  |   25 -
 tools/testing/selftests/bpf/Makefile.skel     |   18 +-
 .../bpf/prog_tests/arena_scalar_blinded.c     |   21 -
 .../selftests/bpf/prog_tests/data_in_arena.c  |  216 ---
 .../selftests/bpf/prog_tests/map_kptr.c       |    5 +
 .../selftests/bpf/prog_tests/rcu_reentry.c    |   19 +-
 .../selftests/bpf/prog_tests/verifier.c       |    2 -
 .../selftests/bpf/progs/arena_noarena.c       |   15 -
 .../selftests/bpf/progs/data_in_arena.c       |  112 --
 .../selftests/bpf/progs/data_in_arena_decl.c  |   37 -
 .../bpf/progs/data_in_arena_extern.c          |   20 -
 .../selftests/bpf/progs/data_in_arena_fail.c  |   20 -
 .../selftests/bpf/progs/data_in_arena_nomap.c |   20 -
 .../selftests/bpf/progs/data_in_arena_rust.rs |   73 --
 .../selftests/bpf/progs/verifier_arena.c      |   15 +
 .../bpf/progs/verifier_arena_scalar.c         | 1155 -----------------
 .../selftests/bpf/progs/verifier_bounds.c     |   41 +
 .../selftests/bpf/progs/verifier_scev.c       |  209 ++-
 .../selftests/bpf/progs/verifier_stack_arg.c  |  119 ++
 tools/testing/selftests/bpf/test_loader.c     |    2 -
 37 files changed, 525 insertions(+), 2378 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/prog_tests/arena_scalar_blinded.c
 delete mode 100644 tools/testing/selftests/bpf/prog_tests/data_in_arena.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena_decl.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena_extern.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena_fail.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena_nomap.c
 delete mode 100644 tools/testing/selftests/bpf/progs/data_in_arena_rust.rs
 delete mode 100644 tools/testing/selftests/bpf/progs/verifier_arena_scalar.c


base-commit: 9ce722236a20e7a913b54df8b6098ec6324ba58a
-- 
2.55.0


^ permalink raw reply	[flat|nested] 25+ messages in thread
end of thread, other threads:[~2026-10-28  4:53 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-27 19:02 [PATCH v2 bpf 00/19] bpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks Alexei Starovoitov
2026-10-27 19:02 ` [PATCH v2 bpf 01/19] selftests/bpf: Remove tests for global data in arena Alexei Starovoitov
2026-10-27 19:02 ` [PATCH v2 bpf 02/19] libbpf: Remove .arena.data Alexei Starovoitov
2026-10-27 19:02 ` [PATCH v2 bpf 03/19] libbpf: Keep format strings of bpf_printk() in .rodata Alexei Starovoitov
2026-10-27 19:02 ` [PATCH v2 bpf 04/19] selftests/bpf: Remove tests for arena access through numbers Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 05/19] bpf: Remove BPF_F_ARENA_SCALAR Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 06/19] bpf, x86: Remove r0_on_stack from fetching atomics in arena Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 07/19] bpf: Clear delta of a register that scalar evolution widens Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 08/19] selftests/bpf: Test that a widened register is not linked Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 09/19] selftests/bpf: Wait for the last maps of map_kptr to be freed Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 10/19] selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 11/19] bpf: Don't widen a pointer to a buffer in scalar evolution Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 12/19] selftests/bpf: Test a loop that moves a pointer to a buffer Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 13/19] bpf: Don't clamp a register whose type changed in the loop Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 14/19] bpf: Reset the range of a packet pointer that scalar evolution clamps Alexei Starovoitov
2026-10-27 19:30   ` sashiko-bot
2026-10-27 20:09     ` Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 15/19] selftests/bpf: Test the clamp of pointers in scalar evolution Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 16/19] bpf: Finish the insn in the state that maybe_fork_scalars() splits off Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 17/19] selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 18/19] bpf: Keep stack arguments in arch_bpf_timed_may_goto() Alexei Starovoitov
2026-10-27 19:48   ` bot+bpf-ci
2026-10-28  4:53     ` Alexei Starovoitov
2026-10-27 19:03 ` [PATCH v2 bpf 19/19] selftests/bpf: Test stack arguments across may_goto Alexei Starovoitov
2026-10-28  4:10 ` [PATCH v2 bpf 00/19] bpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox