Merge branch 'bpf-remove-bpf_f_arena_scalar-fix-scalar-evolution-and-scalar-forks'

Alexei Starovoitov says:

====================
bpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks

From: Alexei Starovoitov <ast@kernel.org>

This series removes BPF_F_ARENA_SCALAR and fixes bugs in scalar evolution,
in maybe_fork_scalars() and in the trampoline of may_goto. The groups of
patches do not depend on each other.

v1 was Part 1 of "bpf: Stack in arena and a verifier that joins states"
[1]. Parts 2 and 3 of that series are not here.

 - Patches 1-6 remove BPF_F_ARENA_SCALAR, .arena.data and what came with
   them. The flag lets a prog access arena through plain numbers, for
   languages that have no address spaces. The compiler can emit one
   addr_space_cast for each pointer instead. That is cheaper than one more
   insn for each access. No released kernel has the flag.
 - Patches 7-8: scalar evolution does not clear 'delta' in a register that
   it widens. Then the verifier calculates an incorrect range for a linked
   register, and an unsafe prog loads.
 - Patches 9-10 make two selftests reliable: map_kptr and rcu_reentry.
 - Patches 11-12: scalar evolution widens a pointer to a buffer
   (PTR_TO_BUF). The verifier rejects an access to a buffer at a variable
   offset. Thus it rejects a correct loop over the per-cpu values of a map
   element.
 - Patches 13-15: two bugs in the clamp of scalar evolution. A pointer that
   the loop invalidates becomes a scalar with the range of the offsets of
   the pointer. A packet pointer keeps a range that is not valid for its
   new offsets. In the two cases an unsafe prog loads and crashes the
   kernel.
 - Patches 16-17: maybe_fork_scalars() splits a state in two and verifies
   the second state later, from the same insn. In a loop that scalar
   evolution counted, pruning drops the second state. Then no one verifies
   one of the two values, and a prog that reads out of bounds loads.
 - Patches 18-19: arch_bpf_timed_may_goto() does not save the registers in
   which the JITs pass stack arguments. After may_goto such an argument is
   not what the verifier knows about it. An unsafe prog crashes the kernel.

Tests on x86-64, compared with the same tests on the base:

  test_progs, test_progs-no_alu32, test_progs-cpuv4,   no new failure
  test_progs-bpf_gcc, test_verifier, test_maps
  test_progs with KASAN                                no new failure
  veristat, 36 weekly builds of Cilium, 5032 progs     same verdicts,
                                                       insns -0.03%
  veristat, sched-ext/scx, 563 progs                   same verdicts
  veristat, selftests from clang 21, clang 24 and GCC  see below

In the selftests the verdict changes only for the tests of this series and
for the tests of .arena.data. The change in Cilium is from patch 16. arm64
is compile tested.

v1 -> v2:
 - Rebase on the fixes for scalar evolution from Eduard.
 - Drop "bpf: One time slice of may_goto for a run of a prog" and its
   tests. The patch has bugs. The insns at the exit of a subprog change R2,
   which is a part of a 16-byte return value (Ihor). A nested run of the
   prog starts the time slice again. I will send it as a separate series.
 - Patch 7: use clear_scalar_id() (Daniel).
 - Drop "bpf: Fix a false verifier bug in the clamp of scalar evolution"
   and its tests. Commit 0c33d612bdd5 ("bpf: Do not intersect with current
   register range on clamp") fixes the bug in a better way (Eduard).
 - Patch 5: name the two schedulers in C that set the flag.
 - Patch 11: correct the reason why two selftests load today.
 - Add patches 10, 13-15 and 18-19.
 - Add patches 16-17. They were patch 46 and a part of patch 75 in v1. The
   bug is in the tree today (Ihor). The log in v1 said that no prog is
   affected. That was wrong.

[1] https://lore.kernel.org/bpf/20261026025943.404450-1-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
====================

Link: https://patch.msgid.link/20261027190314.1440199-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions