Changes in fixups.c

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/kernel/bpf/fixups.c

eb0d6d97c27c29cd7392c8fd74f46edf7dff7ec2 - Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Sat, 18 Apr 2026 00:58:22 +0200

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfPull bpf fixes from Alexei Starovoitov: "Most of the diff stat comes from Xu Kuohai's fix to emit ENDBR/BTI, since all JITs had to be touched to move constant blinding out and pass bpf_verifier_env in. - Fix use-after-free in arena_vm_close on fork (Alexei Starovoitov) - Dissociate struct_ops program with map if map_update fails (Amery Hung) - Fix out-of-range and off-by-one bugs in arm64 JIT (Daniel Borkmann) - Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel Borkmann) - Fix arg tracking for imprecise/multi-offset in BPF_ST/STX insns (Eduard Zingerman) - Copy token from main to subprogs to fix missing kallsyms (Eduard Zingerman) - Prevent double close and leak of btf objects in libbpf (Jiri Olsa) - Fix af_unix null-ptr-deref in sockmap (Michal Luczaj) - Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta Yatsenko) - Avoid unnecessary IPIs. Remove redundant bpf_flush_icache() in arm64 and riscv JITs (Puranjay Mohan) - Fix out of bounds access. Validate node_id in arena_alloc_pages() (Puranjay Mohan) - Reject BPF-to-BPF calls and callbacks in arm32 JIT (Puranjay Mohan) - Refactor all JITs to pass bpf_verifier_env to emit ENDBR/BTI for indirect jump targets on x86-64, arm64 JITs (Xu Kuohai) - Allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)"* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (32 commits) bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT bpf: Dissociate struct_ops program with map if map_update fails bpf: Validate node_id in arena_alloc_pages() libbpf: Prevent double close and leak of btf objects selftests/bpf: cover UTF-8 trace_printk output bpf: allow UTF-8 literals in bpf_bprintf_prepare() selftests/bpf: Reject scalar store into kptr slot bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Fix precedence bug in convert_bpf_ld_abs alignment check bpf, arm64: Emit BTI for indirect jump target bpf, x86: Emit ENDBR for indirect jump targets bpf: Add helper to detect indirect jump targets bpf: Pass bpf_verifier_env to JIT bpf: Move constants blinding out of arch-specific JITs bpf, sockmap: Take state lock for af_unix iter bpf, sockmap: Fix af_unix null-ptr-deref in proto update selftests/bpf: Extend bpf_iter_unix to attempt deadlocking bpf, sockmap: Fix af_unix iter deadlock bpf, sockmap: Annotate af_unix sock:: Sk_state data-races selftests/bpf: verify kallsyms entries for token-loaded subprograms ... List of files: /linux/kernel/bpf/fixups.c

1cedfe17badeebdcc044855713597ac7db58414a - Merge branch 'emit-endbr-bti-instructions-for-indirect'

Thu, 16 Apr 2026 16:03:41 +0200

Merge branch 'emit-endbr-bti-instructions-for-indirect'Xu Kuohai says:====================emit ENDBR/BTI instructions for indirectOn architectures with CFI protection enabled that require landing padinstructions at indirect jump targets, such as x86 with CET/IBT enabledand arm64 with BTI enabled, kernel panics when an indirect jump lands ona target without landing pad. Therefore, the JIT must emit landing padinstructions for indirect jump targets.The verifier already recognizes which instructions are indirect jumptargets during the verification phase. So we can store this informationin env->insn_aux_data and pass it to the JIT as new parameter, allowingthe JIT to consult env->insn_aux_data to determine which instructions areindirect jump targets.During JIT, constants blinding is performed. It rewrites the private copyof instructions for the JITed program, but it does not adjust the globalenv->insn_aux_data array. As a result, after constants blinding, theinstruction indexes used by JIT may no longer match the indexes inenv->insn_aux_data, so the JIT can not use env->insn_aux_data directly.To avoid this mismatch, and given that all existing arch-specific JITsalready implement constants blinding with largely duplicated code, moveconstants blinding from JIT to generic code.v15:- Rebase and target bpf tree- Resotre subprog_start of the fake 'exit' subprog on failure- Fix wrong function name used in commentv14: https://lore.kernel.org/all/cover.1776062885.git.xukuohai@hotmail.com/- Rebase- Fix comment style- Fix incorrect variable and function name used in commit messagev13: https://lore.kernel.org/bpf/20260411133847.1042658-1-xukuohai@huaweicloud.com- Use vmalloc to allocate memory for insn_aux_data copies to match with vfree- Do not free the copied memory of insn_aux_data when restoring from failure- Code cleanupv12: https://lore.kernel.org/bpf/20260403132811.753894-1-xukuohai@huaweicloud.com- Restore env->insn_aux_data on JIT failure- Fix incorrect error code sign (-EFAULT vs EFAULT)- Fix incorrect prog used in the restore pathv11: https://lore.kernel.org/bpf/20260403090915.473493-1-xukuohai@huaweicloud.com- Restore env->subprog_info after jit_subprogs() fails- Clear prog->jit_requested and prog->blinding_requested on failure- Use the actual env->insn_aux_data size in clear_insn_aux_data() on failurev10: https://lore.kernel.org/bpf/20260324122052.342751-1-xukuohai@huaweicloud.com- Fix the incorrect call_imm restore in jit_subprogs- Define a dummy void version of bpf_jit_prog_release_other and bpf_patch_insn_data when the corresponding config is not set- Remove the unnecessary #ifdef in x86_64 JIT (Leon Hwang)v9: https://lore.kernel.org/bpf/20260312170255.3427799-1-xukuohai@huaweicloud.com- Make constant blinding available for classic bpf (Eduard)- Clear prog->bpf_func, prog->jited ... on the error path of extra pass (Eduard)- Fix spelling errors and remove unused parameter (Anton Protopopov)v8: https://lore.kernel.org/bpf/20260309140044.2652538-1-xukuohai@huaweicloud.com- Define void bpf_jit_blind_constants() function when CONFIG_BPF_JIT is not set- Move indirect_target fixup for insn patching from bpf_jit_blind_constants() to adjust_insn_aux_data()v7: https://lore.kernel.org/bpf/20260307103949.2340104-1-xukuohai@huaweicloud.com- Move constants blinding logic back to bpf/core.c- Compute ip address before switch statement in x86 JIT- Clear JIT state from error path on arm64 and loongarchv6: https://lore.kernel.org/bpf/20260306102329.2056216-1-xukuohai@huaweicloud.com- Move constants blinding from JIT to verifier- Move call to bpf_prog_select_runtime from bpf_prog_load to verifierv5: https://lore.kernel.org/bpf/20260302102726.1126019-1-xukuohai@huaweicloud.com- Switch to pass env to JIT directly to get rid of copying private insn_aux_data for each progv4: https://lore.kernel.org/all/20260114093914.2403982-1-xukuohai@huaweicloud.com- Switch to the approach proposed by Eduard, using insn_aux_data to identify indirect jump targets, and emit ENDBR on x86v3: https://lore.kernel.org/bpf/20251227081033.240336-1-xukuohai@huaweicloud.com- Get rid of unnecessary enum definition (Yonghong Song, Anton Protopopov)v2: https://lore.kernel.org/bpf/20251223085447.139301-1-xukuohai@huaweicloud.com- Exclude instruction arrays not used for indirect jumps (Anton Protopopov)v1: https://lore.kernel.org/bpf/20251127140318.3944249-1-xukuohai@huaweicloud.com====================Link: https://patch.msgid.link/20260416064341.151802-1-xukuohai@huaweicloud.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

07ae6c130b46cf5e3e1a7dc5c1889fefe9adc2d3 - bpf: Add helper to detect indirect jump targets

Thu, 16 Apr 2026 08:43:39 +0200

bpf: Add helper to detect indirect jump targetsIntroduce helper bpf_insn_is_indirect_target to check whether a BPFinstruction is an indirect jump target.Since the verifier knows which instructions are indirect jump targets,add a new flag indirect_target to struct bpf_insn_aux_data to markthem. The verifier sets this flag when verifying an indirect jump targetinstruction, and the helper checks the flag to determine whether aninstruction is an indirect jump target.Reviewed-by: Anton Protopopov #v8Reviewed-by: Emil Tsalapatis #v12Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-4-xukuohai@huaweicloud.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

d9ef13f72711f2dad64cd4445472ded98fb6c954 - bpf: Pass bpf_verifier_env to JIT

Thu, 16 Apr 2026 08:43:38 +0200

bpf: Pass bpf_verifier_env to JITPass bpf_verifier_env to bpf_int_jit_compile(). The follow-up patch willuse env->insn_aux_data in the JIT stage to detect indirect jump targets.Since bpf_prog_select_runtime() can be called by cbpf and lib/test_bpf.ccode without verifier, introduce helper __bpf_prog_select_runtime()to accept the env parameter.Remove the call to bpf_prog_select_runtime() in bpf_prog_load(), andswitch to call __bpf_prog_select_runtime() in the verifier, with envvariable passed. The original bpf_prog_select_runtime() is preserved forcbpf and lib/test_bpf.c, where env is NULL.Now all constants blinding calls are moved into the verifier, exceptthe cbpf and lib/test_bpf.c cases. The instructions arrays are adjustedby bpf_patch_insn_data() function for normal cases, so there is no needto call adjust_insn_arrays() in bpf_jit_blind_constants(). Remove it.Reviewed-by: Anton Protopopov # v8Reviewed-by: Emil Tsalapatis # v12Acked-by: Hengqi Chen # v14Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-3-xukuohai@huaweicloud.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

d3e945223e0158c85dbde23de4f89493a2a817f6 - bpf: Move constants blinding out of arch-specific JITs

Thu, 16 Apr 2026 08:43:37 +0200

bpf: Move constants blinding out of arch-specific JITsDuring the JIT stage, constants blinding rewrites instructions but onlyrewrites the private instruction copy of the JITed subprog, leaving theglobal env->prog->insnsi and env->insn_aux_data untouched. This causes amismatch between subprog instructions and the global state, making itdifficult to use the global data in the JIT.To avoid this mismatch, and given that all arch-specific JITs alreadysupport constants blinding, move it to the generic verifier code, andswitch to rewrite the global env->prog->insnsi with the global statesadjusted, as other rewrites in the verifier do.This removes the constants blinding calls in each JIT, which are largelyduplicated code across architectures.Since constants blinding is only required for JIT, and there are twoJIT entry functions, jit_subprogs() for BPF programs with multiplesubprogs and bpf_prog_select_runtime() for programs with no subprogs,move the constants blinding invocation into these two functions.In the verifier path, bpf_patch_insn_data() is used to keep globalverifier auxiliary data in sync with patched instructions. A keyquestion is whether this global auxiliary data should be restoredon the failure path.Besides instructions, bpf_patch_insn_data() adjusts: - prog->aux->poke_tab - env->insn_array_maps - env->subprog_info - env->insn_aux_dataFor prog->aux->poke_tab, it is only used by JIT or only meaningful afterJIT succeeds, so it does not need to be restored on the failure path.For env->insn_array_maps, when JIT fails, programs using insn arraysare rejected by bpf_insn_array_ready() due to missing JIT addresses.Hence, env->insn_array_maps is only meaningful for JIT and does not needto be restored.For subprog_info, if jit_subprogs fails and CONFIG_BPF_JIT_ALWAYS_ONis not enabled, kernel falls back to interpreter. In this case,env->subprog_info is used to determine subprogram stack depth. So itmust be restored on failure.For env->insn_aux_data, it is freed by clear_insn_aux_data() at theend of bpf_check(). Before freeing, clear_insn_aux_data() loops overenv->insn_aux_data to release jump targets recorded in it. The loopuses env->prog->len as the array length, but this length no longermatches the actual size of the adjusted env->insn_aux_data array afterconstants blinding.To address it, a simple approach is to keep insn_aux_data as adjustedafter failure, since it will be freed shortly, and record its actual sizefor the loop in clear_insn_aux_data(). But since clear_insn_aux_data()uses the same index to loop over both env->prog->insnsi and env->insn_aux_data,this approach results in incorrect index for the insnsi array. So analternative approach is adopted: clone the original env->insn_aux_databefore blinding and restore it after failure, similar to env->prog.For classic BPF programs, constants blinding works as before since itis still invoked from bpf_prog_select_runtime().Reviewed-by: Anton Protopopov # v8Reviewed-by: Hari Bathini # powerpc jitReviewed-by: Pu Lehui # riscv jitAcked-by: Hengqi Chen # loongarch jitSigned-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-2-xukuohai@huaweicloud.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

9d8e92e15f75794c469f586a2c47fab58f093a3a - Merge branch 'bpf-copy-bpf-token-from-main-program-to-subprograms'

Thu, 16 Apr 2026 01:46:47 +0200

Merge branch 'bpf-copy-bpf-token-from-main-program-to-subprograms'Eduard Zingerman says:====================bpf: copy BPF token from main program to subprogramsbpf_jit_subprogs() omits aux->token when it creates a structbpf_prog_aux instances for a subprograms.This means that for programs loaded via BPF token (i.e., from anon-init user namespace), subprograms fail the bpf_token_capable()check in bpf_prog_kallsyms_add() and don't appear in /proc/kallsyms.Which in-turn makes it impossible to freplace such subprograms.Changelog:v3 -> v4:- check sysctl_set calls for errors (sashiko).v2 -> v3:- mark selftest as serial (sashiko).v1 -> v2:- target bpf-next tree (fixups.c) instead of bpf tree (verifier.c).v1: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v1-0-5b1a38e01546@gmail.com/T/v2: https://lore.kernel.org/bpf/20260414-subprog-token-fix-v2-0-59146c31f6f1@gmail.com/T/v3: https://lore.kernel.org/bpf/20260415-subprog-token-fix-v3-0-6fefe1d51646@gmail.com/T/====================Link: https://patch.msgid.link/20260415-subprog-token-fix-v4-0-9bd000e8b068@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

0251e40c48299243c12f7cf4a6046f080af206cb - bpf: copy BPF token from main program to subprograms

Wed, 15 Apr 2026 22:03:55 +0200

bpf: copy BPF token from main program to subprogramsbpf_jit_subprogs() copies various fields from the main program's aux toeach subprogram's aux, but omits the BPF token. This causesbpf_prog_kallsyms_add() to fail for subprograms loaded via BPF token,as bpf_token_capable() falls back to capable() in init_user_ns whentoken is NULL.Copy prog->aux->token to func[i]->aux->token so that subprogramsinherit the same capability delegation as the main program.Fixes: d79a35497547 ("bpf: Consistently use BPF token throughout BPF verifier logic")Signed-off-by: Tao Chen Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260415-subprog-token-fix-v4-1-9bd000e8b068@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

f5ad4101009e7f5f5984ffea6923d4fcd470932a - Merge tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Wed, 15 Apr 2026 03:04:04 +0200

Merge tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Alexei Starovoitov: - Welcome new BPF maintainers: Kumar Kartikeya Dwivedi, Eduard Zingerman while Martin KaFai Lau reduced his load to Reviwer. - Lots of fixes everywhere from many first time contributors. Thank you All. - Diff stat is dominated by mechanical split of verifier.c into multiple components: - backtrack.c: backtracking logic and jump history - states.c: state equivalence - cfg.c: control flow graph, postorder, strongly connected components - liveness.c: register and stack liveness - fixups.c: post-verification passes: instruction patching, dead code removal, bpf_loop inlining, finalize fastcall 8k line were moved. verifier.c still stands at 20k lines. Further refactoring is planned for the next release. - Replace dynamic stack liveness with static stack liveness based on data flow analysis. This improved the verification time by 2x for some programs and equally reduced memory consumption. New logic is in liveness.c and supported by constant folding in const_fold.c (Eduard Zingerman, Alexei Starovoitov) - Introduce BTF layout to ease addition of new BTF kinds (Alan Maguire) - Use kmalloc_nolock() universally in BPF local storage (Amery Hung) - Fix several bugs in linked registers delta tracking (Daniel Borkmann) - Improve verifier support of arena pointers (Emil Tsalapatis) - Improve verifier tracking of register bounds in min/max and tnum domains (Harishankar Vishwanathan, Paul Chaignon, Hao Sun) - Further extend support for implicit arguments in the verifier (Ihor Solodrai) - Add support for nop,nop5 instruction combo for USDT probes in libbpf (Jiri Olsa) - Support merging multiple module BTFs (Josef Bacik) - Extend applicability of bpf_kptr_xchg (Kaitao Cheng) - Retire rcu_trace_implies_rcu_gp() (Kumar Kartikeya Dwivedi) - Support variable offset context access for 'syscall' programs (Kumar Kartikeya Dwivedi) - Migrate bpf_task_work and dynptr to kmalloc_nolock() (Mykyta Yatsenko) - Fix UAF in in open-coded task_vma iterator (Puranjay Mohan)* tag 'bpf-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (241 commits) selftests/bpf: cover short IPv4/IPv6 inputs with adjust_room bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb selftests/bpf: Use memfd_create instead of shm_open in cgroup_iter_memcg selftests/bpf: Add test for cgroup storage OOB read bpf: Fix OOB in pcpu_init_value selftests/bpf: Fix reg_bounds to match new tnum-based refinement selftests/bpf: Add tests for non-arena/arena operations bpf: Allow instructions with arena source and non-arena dest registers bpftool: add missing fsession to the usage and docs of bpftool docs/bpf: add missing fsession attach type to docs bpf: add missing fsession to the verifier log bpf: Move BTF checking logic into check_btf.c bpf: Move backtracking logic to backtrack.c bpf: Move state equivalence logic to states.c bpf: Move check_cfg() into cfg.c bpf: Move compute_insn_live_regs() into liveness.c bpf: Move fixup/post-processing logic from verifier.c into fixups.c bpf: Simplify do_check_insn() bpf: Move checks for reserved fields out of the main pass bpf: Delete unused variable ... List of files: /linux/kernel/bpf/fixups.c

46ffc1f78295b8fdb587b99ffc18f29e00ec3a30 - Merge branch 'bpf-split-verifier-c'

Sun, 12 Apr 2026 21:34:31 +0200

Merge branch 'bpf-split-verifier-c'Alexei Starovoitov says:====================v3->v4: Restore few minor comments and undo few function movesv2->v3: Actually restore comments lost in patch 3(instead of adding them to patch 4)v1->v2: Restore comments lost in patch 3verifier.c is huge. Split it into logically independent pieces.No functional changes.The diff is impossible to review over email.'git show' shows minimal actual changes. Only plenty of moved lines.Such split may cause backport headaches.We should have split it long ago.Even after split verifier.c is still 20k lines,but further split is harder.====================Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260412152936.54262-1-alexei.starovoitov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c

449f08fa59dda5da40317b6976604b877c4ecd63 - bpf: Move fixup/post-processing logic from verifier.c into fixups.c

Sun, 12 Apr 2026 17:29:30 +0200

bpf: Move fixup/post-processing logic from verifier.c into fixups.cverifier.c is huge. Split fixup/post-processing logic that runs afterthe verifier accepted the program into fixups.c.Mechanical move. No functional changes.Acked-by: Kumar Kartikeya Dwivedi Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260412152936.54262-2-alexei.starovoitov@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/kernel/bpf/fixups.c