Changes in test_map_uninit.c

5a8cd539ac19f7a68e68e1d25ef9ca2ff55b8500 - Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Thu, 20 Aug 2026 16:36:20 +0200

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests"* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ... List of files: /linux/tools/testing/selftests/bpf/prog_tests/test_map_uninit.c

fab183d632628381b466a41479489541ac0e29a0 - sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3

Mon, 17 Aug 2026 23:20:34 +0200

sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3Pull to receive the __arena argument conversion: 67f1f4a48c24 ("sched_ext: Pass kernel arena pointers to ops_cid callbacks") a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") a05c5b5cb5cf ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")along with the bpf-next branch carrying the __arena argument support theydepend on.Conflict in kernel/sched/ext/ext.c between: c384ab8a0b13 ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")and: a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")which updated the stubs in their old ext.c location. Resolved by keepingext.c without the stubs and applying the prototype conversion to therelocated stubs in sub.c.Signed-off-by: Tejun Heo List of files: /linux/tools/testing/selftests/bpf/prog_tests/test_map_uninit.c

872a8f6b08069d1b4bfb9bf968dc629ab6998908 - Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args

Tue, 11 Aug 2026 00:38:03 +0200

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-argsPull bpf-next d114bb989367 ("Merge branch'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arenaand __arena__nullable kfunc and struct_ops argument suffixes available. Thesuffixed arguments will be used to convert sched_ext kfuncs and struct_opscallbacks that currently pass arena pointers as scalars and rebase them byhand. List of files: /linux/tools/testing/selftests/bpf/prog_tests/test_map_uninit.c

09e7d46e33dd95803c3105eaba0e6de02dd1713e - Merge branch 'bpf-copy-per-cpu-map-value-padding-in-copy_map_value_long'

Wed, 01 Jul 2026 20:27:37 +0200

Merge branch 'bpf-copy-per-cpu-map-value-padding-in-copy_map_value_long'Leon Hwang says:====================bpf: Copy per-CPU map value padding in copy_map_value_long()Sashiko reported [1]:This is a pre-existing issue, but does iterating over per-CPU maps exposeuninitialized kernel heap memory?When working with per-CPU maps, temporary buffers are allocated using kmallocwithout the __GFP_ZERO flag in functions like bpf_iter_init_array_map inkernel/bpf/arraymap.c:kernel/bpf/arraymap.c:bpf_iter_init_array_map() { ... value_buf = kmalloc(buf_size, GFP_USER | __GFP_NOWARN); ...}This is also done in kernel/bpf/hashtab.c:bpf_iter_init_hash_map().If the map contains a BTF record, bpf_obj_memcpy in include/linux/bpf.hexplicitly stops at map->value_size instead of filling the entire rounded-upsize:include/linux/bpf.h:bpf_obj_memcpy() { ... memcpy(dst + curr_off, src + curr_off, size - curr_off); ...}This fails to overwrite the padding bytes up to round_up(map->value_size, 8).[1] https://lore.kernel.org/bpf/20260622150844.28C551F000E9@smtp.kernel.org/===For example,struct map_uninit_value { struct prog_test_ref_kfunc __kptr_untrusted *unref_ptr; __u32 data;} __attribute__((packed));struct { __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); __type(key, int); __type(value, struct map_uninit_value); __uint(max_entries, 1);} pcpu_array SEC(".maps");There are 4 padding bytes in the kernel percpu_array map elements.When lookup element from 'pcpu_array' map, for each CPU, the 4 paddingbytes memory allocated by syscall.c::map_lookup_elem():kvmalloc() couldbe exposed to user space.Without the fix, the selftest could fail with:test_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memorymismatchactual: 2B 2B 2B 2Bexpected: 00 00 00 00====================Link: https://patch.msgid.link/20260624155115.85196-1-leon.hwang@linux.devSigned-off-by: Andrii Nakryiko List of files: /linux/tools/testing/selftests/bpf/prog_tests/test_map_uninit.c

163944262f8646bf3a1eec557b6aff1f38582a9f - selftests/bpf: Verify no non-zeroed kernel heap memory exposure

Wed, 24 Jun 2026 17:51:15 +0200

selftests/bpf: Verify no non-zeroed kernel heap memory exposureWhen lookup element from those per-CPU maps, which have special fieldin their values and their value size is not equal to roundup(value_sz, 8),the padding size of temporary non-zeroed kernel heap memory allocated bykvmalloc should not be exposed to user space.Without the fix:test_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memory mismatchactual: 2B 2B 2B 2Bexpected: 00 00 00 00Assisted-by: Codex:gpt-5.5Signed-off-by: Leon Hwang Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260624155115.85196-3-leon.hwang@linux.dev List of files: /linux/tools/testing/selftests/bpf/prog_tests/test_map_uninit.c