Merge branch 'bpf-remove-bpf_f_arena_scalar-fix-scalar-evolution-and-scalar-forks'

Alexei Starovoitov says:

====================
bpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks

From: Alexei Starovoitov <ast@kernel.org>

This series removes BPF_F_ARENA_SCALAR and fixes bugs in scalar evolution,
in maybe_fork_scalars() and in the trampoline of may_goto. The groups of
patches do not depend on each other.

v1 was Part 1 of "bpf: Stack in arena and a verifier that joins states"
[1]. Parts 2 and 3 of that series are not here.

 - Patches 1-6 remove BPF_F_ARENA_SCALAR, .arena.data and what came with
   them. The flag lets a prog access arena through plain numbers, for
   languages that have no address spaces. The compiler can emit one
   addr_space_cast for each pointer instead. That is cheaper than one more
   insn for each access. No released kernel has the flag.
 - Patches 7-8: scalar evolution does not clear 'delta' in a register that
   it widens. Then the verifier calculates an incorrect range for a linked
   register, and an unsafe prog loads.
 - Patches 9-10 make two selftests reliable: map_kptr and rcu_reentry.
 - Patches 11-12: scalar evolution widens a pointer to a buffer
   (PTR_TO_BUF). The verifier rejects an access to a buffer at a variable
   offset. Thus it rejects a correct loop over the per-cpu values of a map
   element.
 - Patches 13-15: two bugs in the clamp of scalar evolution. A pointer that
   the loop invalidates becomes a scalar with the range of the offsets of
   the pointer. A packet pointer keeps a range that is not valid for its
   new offsets. In the two cases an unsafe prog loads and crashes the
   kernel.
 - Patches 16-17: maybe_fork_scalars() splits a state in two and verifies
   the second state later, from the same insn. In a loop that scalar
   evolution counted, pruning drops the second state. Then no one verifies
   one of the two values, and a prog that reads out of bounds loads.
 - Patches 18-19: arch_bpf_timed_may_goto() does not save the registers in
   which the JITs pass stack arguments. After may_goto such an argument is
   not what the verifier knows about it. An unsafe prog crashes the kernel.

Tests on x86-64, compared with the same tests on the base:

  test_progs, test_progs-no_alu32, test_progs-cpuv4,   no new failure
  test_progs-bpf_gcc, test_verifier, test_maps
  test_progs with KASAN                                no new failure
  veristat, 36 weekly builds of Cilium, 5032 progs     same verdicts,
                                                       insns -0.03%
  veristat, sched-ext/scx, 563 progs                   same verdicts
  veristat, selftests from clang 21, clang 24 and GCC  see below

In the selftests the verdict changes only for the tests of this series and
for the tests of .arena.data. The change in Cilium is from patch 16. arm64
is compile tested.

v1 -> v2:
 - Rebase on the fixes for scalar evolution from Eduard.
 - Drop "bpf: One time slice of may_goto for a run of a prog" and its
   tests. The patch has bugs. The insns at the exit of a subprog change R2,
   which is a part of a 16-byte return value (Ihor). A nested run of the
   prog starts the time slice again. I will send it as a separate series.
 - Patch 7: use clear_scalar_id() (Daniel).
 - Drop "bpf: Fix a false verifier bug in the clamp of scalar evolution"
   and its tests. Commit 0c33d612bdd5 ("bpf: Do not intersect with current
   register range on clamp") fixes the bug in a better way (Eduard).
 - Patch 5: name the two schedulers in C that set the flag.
 - Patch 11: correct the reason why two selftests load today.
 - Add patches 10, 13-15 and 18-19.
 - Add patches 16-17. They were patch 46 and a part of patch 75 in v1. The
   bug is in the tree today (Ihor). The log in v1 said that no prog is
   affected. That was wrong.

[1] https://lore.kernel.org/bpf/20261026025943.404450-1-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
====================

Link: https://patch.msgid.link/20261027190314.1440199-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

2 files changed, 6 insertions, 3 deletions

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index e51984cb3035..7baeb831281f 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -782,7 +782,6 @@ struct bpf_insn_aux_data {
 	u64 non_sleepable:1; /* helper/kfunc may be called from non-sleepable context */
 	u64 is_iter_next:1; /* bpf_iter_<type>_next() kfunc call */
 	u64 call_with_percpu_alloc_ptr:1; /* {this,per}_cpu_ptr() with prog percpu alloc */
-	u64 arena_scalar:1; /* ldx/stx/st/atomic through a number, it's an address in arena */
 	u64 bb_end:1; /* last instruction of a basic block */
 	u64 need_scev:1;
 	u64 alu_state:5; /* used in combination with alu_limit */
@@ -1074,7 +1073,6 @@ struct bpf_verifier_env {
 	bool strict_alignment;		/* perform strict pointer alignment checks */
 	bool test_state_freq;		/* test verifier with different pruning frequency */
 	bool test_reg_invariants;	/* fail verification on register invariants violations */
-	bool arena_scalar;		/* load and store through a number is arena access */
 	struct bpf_verifier_state *cur_state; /* current verifier state */
 	/* Search pruning optimization, array of list_heads for
 	 * lists of struct bpf_verifier_state_list.
@@ -1315,6 +1313,12 @@ static inline bool bpf_is_force_checkpoint(struct bpf_verifier_env *env, int ins
 	return env->insn_aux_data[insn_idx].force_checkpoint;
 }
 
+static inline void clear_scalar_id(struct bpf_reg_state *reg)
+{
+	reg->id = 0;
+	reg->delta = 0;
+}
+
 static inline void mark_calls_callback(struct bpf_verifier_env *env, int idx)
 {
 	env->insn_aux_data[idx].calls_callback = true;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index e0218e677a1d..98254742ae37 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1287,7 +1287,6 @@ bool bpf_jit_supports_far_kfunc_call(void);
 bool bpf_jit_supports_exceptions(void);
 bool bpf_jit_supports_ptr_xchg(void);
 bool bpf_jit_supports_arena(void);
-bool bpf_jit_supports_arena_scalar(void);
 bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena);
 bool bpf_jit_supports_private_stack(void);
 bool bpf_jit_supports_large_stack(void);