Changes in tailcall_callback.c

5a8cd539ac19f7a68e68e1d25ef9ca2ff55b8500 - Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Thu, 20 Aug 2026 16:36:20 +0200

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextPull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests"* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ... List of files: /linux/tools/testing/selftests/bpf/progs/tailcall_callback.c

fab183d632628381b466a41479489541ac0e29a0 - sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3

Mon, 17 Aug 2026 23:20:34 +0200

sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3Pull to receive the __arena argument conversion: 67f1f4a48c24 ("sched_ext: Pass kernel arena pointers to ops_cid callbacks") a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") a05c5b5cb5cf ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments")along with the bpf-next branch carrying the __arena argument support theydepend on.Conflict in kernel/sched/ext/ext.c between: c384ab8a0b13 ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c")and: a8dc810968af ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments")which updated the stubs in their old ext.c location. Resolved by keepingext.c without the stubs and applying the prototype conversion to therelocated stubs in sub.c.Signed-off-by: Tejun Heo List of files: /linux/tools/testing/selftests/bpf/progs/tailcall_callback.c

872a8f6b08069d1b4bfb9bf968dc629ab6998908 - Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-args

Tue, 11 Aug 2026 00:38:03 +0200

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next into for-7.3-arena-argsPull bpf-next d114bb989367 ("Merge branch'add-arena-argument-support-to-kfuncs-and-struct_ops'") to make the __arenaand __arena__nullable kfunc and struct_ops argument suffixes available. Thesuffixed arguments will be used to convert sched_ext kfuncs and struct_opscallbacks that currently pass arena pointers as scalars and rebase them byhand. List of files: /linux/tools/testing/selftests/bpf/progs/tailcall_callback.c

ba6cb45969961d482aa8b8cffa55472114e78520 - Merge branch 'fixes-for-tailcall-with-subprog-and-callback'

Fri, 17 Jul 2026 02:46:26 +0200

Merge branch 'fixes-for-tailcall-with-subprog-and-callback'Pu Lehui says:====================Fixes for tailcall with subprog and callbackFrom: Pu Lehui This series fix two issues related to tailcall:patch 1: Fix tail_call_reachable state leak across call branches.patch 2: Reject callback subprogs invoke tailcall.patch 3: testcases for patch 1 and 2.v3:- Fix tail_call_reachable state leak across call branches. (Sashiko)- Add testcase for the above issue.v2:https://lore.kernel.org/bpf/20260714024459.420075-1-pulehui@huaweicloud.com- Remove redantant testcase.- Add ACK tag by Eduard.v1:https://lore.kernel.org/bpf/20260711104727.4023420-1-pulehui@huaweicloud.com====================Link: https://patch.msgid.link/20260716120157.835937-1-pulehui@huaweicloud.comSigned-off-by: Eduard Zingerman List of files: /linux/tools/testing/selftests/bpf/progs/tailcall_callback.c

42bfd21a8b70143e68ae6d017752abb3f04738f5 - selftests/bpf: Add testcases for callback with tailcall

Thu, 16 Jul 2026 14:01:57 +0200

selftests/bpf: Add testcases for callback with tailcallAdd 2 testcases for callback with tailcall:1. failure case: callback->subprog->tailcall.2. success case: subprog with tailcall do not affect no-tailcall callback.Signed-off-by: Pu Lehui Link: https://patch.msgid.link/20260716120157.835937-4-pulehui@huaweicloud.comSigned-off-by: Eduard Zingerman List of files: /linux/tools/testing/selftests/bpf/progs/tailcall_callback.c