Changes in fentry_sleepable.c

5a8cd539ac19f7a68e68e1d25ef9ca2ff55b8500 - Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Thu, 20 Aug 2026 16:36:20 +0200

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests"* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ... List of files: /linux/tools/testing/selftests/bpf/progs/fentry_sleepable.c

fab183d632628381b466a41479489541ac0e29a0 - sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3

Mon, 17 Aug 2026 23:20:34 +0200

sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3Pull to receive the __arena argument conversion: 67f1f4a48c24 ("sched_ext: Pass kernel arena pointers to ops_cid callbacks") a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") a05c5b5cb5cf ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")along with the bpf-next branch carrying the __arena argument support theydepend on.Conflict in kernel/sched/ext/ext.c between: c384ab8a0b13 ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")and: a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")which updated the stubs in their old ext.c location. Resolved by keepingext.c without the stubs and applying the prototype conversion to therelocated stubs in sub.c.Signed-off-by: Tejun Heo List of files: /linux/tools/testing/selftests/bpf/progs/fentry_sleepable.c

872a8f6b08069d1b4bfb9bf968dc629ab6998908 - Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args

Tue, 11 Aug 2026 00:38:03 +0200

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-argsPull bpf-next d114bb989367 ("Merge branch'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arenaand __arena__nullable kfunc and struct_ops argument suffixes available. Thesuffixed arguments will be used to convert sched_ext kfuncs and struct_opscallbacks that currently pass arena pointers as scalars and rebase them byhand. List of files: /linux/tools/testing/selftests/bpf/progs/fentry_sleepable.c

9f04670efab1311ea57d8422a5db5f43e4765ee9 - Merge branch 'bpf-fix-sleepable-check-for-tracing-lsm-prog'

Wed, 05 Aug 2026 20:38:36 +0200

Merge branch 'bpf-fix-sleepable-check-for-tracing-lsm-prog'Leon Hwang says:====================bpf: Fix sleepable check for tracing/lsm progWhen CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing progis allowed to attach to '__x64_'-alike prefix symbols.It is because the verifier does not verify whether the symbol is a kernelfunction or a bpf prog. That said, a sleepable tracing prog is allowed toattach to a bpf prog target whose name has '__x64_'-alike prefix.For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDPprog, and copies buffer from a user pointer with bpf_copy_from_user()helper. After attaching the XDP prog to lo interface, the kernel BUGcould be triggered by 'ping -c 1 -W 1 127.0.0.1':[ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324Fix it by disallowing sleepable prog always when its targetbtf is not kernel's btf.Changes:v3 -> v4:* Move btf check outside of 'switch (prog->type)'. (per Andrii)* v3: https://lore.kernel.org/bpf/20260804145710.43062-1-leon.hwang@linux.dev/v2 -> v3:* Use btf_is_kernel() instead of passing 'tgt_prog'. (per Andrii)* v2: https://lore.kernel.org/bpf/20260725132624.78373-1-leon.hwang@linux.dev/v1 -> v2:* Drop redundant 'prog->sleepable' check. (per Viktor)* Collect Acked-by from Viktor, Thanks.* v1: https://lore.kernel.org/bpf/20260724141422.10463-1-leon.hwang@linux.dev/====================Link: https://patch.msgid.link/20260805150810.34907-1-leon.hwang@linux.devSigned-off-by: Andrii Nakryiko List of files: /linux/tools/testing/selftests/bpf/progs/fentry_sleepable.c

045809795751897ebbb82ab775edd8a3d040d66f - selftests/bpf: Verify rejection of sleepable tracing prog

Wed, 05 Aug 2026 17:08:10 +0200

selftests/bpf: Verify rejection of sleepable tracing progAdd a test to verify that the sleepable tracing prog cannot attach to a'__x64_sys' prefix prog target.When CONFIG_FUNCTION_ERROR_INJECTION is disabled, without the fix, thetest would trigger the BUG:[ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324Signed-off-by: Leon Hwang Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20260805150810.34907-3-leon.hwang@linux.dev List of files: /linux/tools/testing/selftests/bpf/progs/fentry_sleepable.c