Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that
   were added for rust-bpf in this merge window. We found a cleaner
   approach that does it on compiler side instead of kernel/libbpf. No
   released kernel has them (Alexei Starovoitov)

 - Fix bpf_send_signal_task() returning -EPERM when it is called from a
   kernel thread (Aditya Sharma)

 - Various fixes (Alexei Starovoitov):
     - Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix
       objtool warning during the build
     - Fix scalar evolution: clear delta of a widened register, don't
       widen a pointer to a buffer, don't clamp a register whose type
       changed in the loop, and reset the range of a clamped packet
       pointer
     - Finish the insn in the state that maybe_fork_scalars() splits
       off, so that pruning doesn't drop it at the head of a counted
       loop
     - Preserve the registers that carry stack arguments across
       arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64
     - Don't re-sort subprog_info[] for every new subprogram
     - Fix flaky map_kptr and rcu_reentry selftests

 - Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()
   and bpf_xdp_load_bytes(), since the destination can be a slice of the
   same packet (Ayushman Rout)

 - Fixes and follow-ups for scalar evolution: reject pointer operands in
   32-bit recurrences and latches, don't intersect with the current
   register range on clamp to avoid a false 'verifier bug', avoid false
   infinite loop reports, and recognize a 32-bit copy of the induction
   variable (Eduard Zingerman)

 - Fix out-of-bounds write to btf->types[] for split BTF and propagate
   btf_add_type() errors in btf_check_all_metas() (Feng Yang)

 - Fix use-after-free in bpf_timer callback that fires after its inner
   map was freed (Mani Tofigh)

 - Fix x86 JIT stopping before jumps converge: size backward jumps by
   the insns they jump over (Mykyta Yatsenko)

 - Fix use-after-free of struct_ops trampoline: dissociate struct_ops
   progs before the grace period of the map (Qiliang Yuan)

 - Validate stack argument reads against the caller state to fix
   out-of-bounds read in the verifier, and reject callbacks with stack
   arguments (Weiming Shi)

 - Tie borrowed iterator results and pointers loaded from trusted fields
   to the lifetime of their source, so that iterator next, destroy and
   reference release invalidate them (Xu Yunxiang)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)
  bpf: Don't re-sort subprog_info[] for every new subprogram
  bpf: Fix out-of-bounds btf->types write for split BTF
  selftests/bpf: Test stack arguments across may_goto
  bpf: Keep stack arguments in arch_bpf_timed_may_goto()
  selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
  bpf: Finish the insn in the state that maybe_fork_scalars() splits off
  selftests/bpf: Test the clamp of pointers in scalar evolution
  bpf: Reset the range of a packet pointer that scalar evolution clamps
  bpf: Don't clamp a register whose type changed in the loop
  selftests/bpf: Test a loop that moves a pointer to a buffer
  bpf: Don't widen a pointer to a buffer in scalar evolution
  selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
  selftests/bpf: Wait for the last maps of map_kptr to be freed
  selftests/bpf: Test that a widened register is not linked
  bpf: Clear delta of a register that scalar evolution widens
  bpf, x86: Remove r0_on_stack from fetching atomics in arena
  bpf: Remove BPF_F_ARENA_SCALAR
  selftests/bpf: Remove tests for arena access through numbers
  libbpf: Keep format strings of bpf_printk() in .rodata
  libbpf: Remove .arena.data
  ...

4 files changed, 14 insertions, 7 deletions

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 580f89c450b5..ff0436781293 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1979,7 +1979,7 @@ struct bpf_prog_aux {
 		struct rcu_work rwork;
 	};
 	struct bpf_stream *stream[2];
-	struct mutex st_ops_assoc_mutex;
+	spinlock_t st_ops_assoc_lock; /* protects st_ops_assoc */
 	struct bpf_map __rcu *st_ops_assoc;
 };
 
@@ -2240,9 +2240,11 @@ struct btf_member;
  *                           and its progs. It is unnecessary if the @unreg
  *                           has waited for the correct rcu gp or the @unreg
  *                           has ensured all struct_ops prog has finished running.
- * @free_after_mult_rcu_gp: Same as @free_after_tasks_rcu_gp but waiting for
- *                          both tasks_trace_rcu and regular rcu grace period.
- *                          It is usually needed if the struct_ops has sleepable prog.
+ * @free_after_mult_rcu_gp: Set to true if the cgroup prog array of this
+ *                          struct_ops needs a tasks_trace_rcu gp, besides a
+ *                          regular rcu gp, before it is freed. It is usually
+ *                          needed if the struct_ops has sleepable prog. A
+ *                          struct_ops map always waits for both.
  */
 struct bpf_struct_ops {
 	const struct bpf_verifier_ops *verifier_ops;
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 5926f13ff43c..7baeb831281f 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -782,7 +782,6 @@ struct bpf_insn_aux_data {
 	u64 non_sleepable:1; /* helper/kfunc may be called from non-sleepable context */
 	u64 is_iter_next:1; /* bpf_iter_<type>_next() kfunc call */
 	u64 call_with_percpu_alloc_ptr:1; /* {this,per}_cpu_ptr() with prog percpu alloc */
-	u64 arena_scalar:1; /* ldx/stx/st/atomic through a number, it's an address in arena */
 	u64 bb_end:1; /* last instruction of a basic block */
 	u64 need_scev:1;
 	u64 alu_state:5; /* used in combination with alu_limit */
@@ -1074,7 +1073,6 @@ struct bpf_verifier_env {
 	bool strict_alignment;		/* perform strict pointer alignment checks */
 	bool test_state_freq;		/* test verifier with different pruning frequency */
 	bool test_reg_invariants;	/* fail verification on register invariants violations */
-	bool arena_scalar;		/* load and store through a number is arena access */
 	struct bpf_verifier_state *cur_state; /* current verifier state */
 	/* Search pruning optimization, array of list_heads for
 	 * lists of struct bpf_verifier_state_list.
@@ -1280,6 +1278,7 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
 				  u32 insn_off,
 				  const char *prefix_fmt, ...);
 void bpf_verbose_snum(struct bpf_verifier_env *env, s64 num);
+void bpf_verbose_snum32(struct bpf_verifier_env *env, s32 num);
 
 #define verifier_bug_if(cond, env, fmt, args...)						\
 	({											\
@@ -1314,6 +1313,12 @@ static inline bool bpf_is_force_checkpoint(struct bpf_verifier_env *env, int ins
 	return env->insn_aux_data[insn_idx].force_checkpoint;
 }
 
+static inline void clear_scalar_id(struct bpf_reg_state *reg)
+{
+	reg->id = 0;
+	reg->delta = 0;
+}
+
 static inline void mark_calls_callback(struct bpf_verifier_env *env, int idx)
 {
 	env->insn_aux_data[idx].calls_callback = true;
diff --git a/include/linux/btf.h b/include/linux/btf.h
index b66e20a18c54..a18254b7521b 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -82,6 +82,7 @@
 #define KF_IMPLICIT_ARGS (1 << 16) /* kfunc has implicit arguments supplied by the verifier */
 #define KF_SPINLOCK_SAFE (1 << 17) /* kfunc is allowed inside bpf_spin_lock-ed region */
 #define KF_PERFMON      (1 << 18) /* kfunc requires CAP_PERFMON */
+#define KF_ITER_RET_INDEPENDENT (1 << 19) /* next result outlives the current element */
 
 /*
  * Tag marking a kernel function as a kfunc. This is meant to minimize the
diff --git a/include/linux/filter.h b/include/linux/filter.h
index e0218e677a1d..98254742ae37 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1287,7 +1287,6 @@ bool bpf_jit_supports_far_kfunc_call(void);
 bool bpf_jit_supports_exceptions(void);
 bool bpf_jit_supports_ptr_xchg(void);
 bool bpf_jit_supports_arena(void);
-bool bpf_jit_supports_arena_scalar(void);
 bool bpf_jit_supports_insn(struct bpf_insn *insn, bool in_arena);
 bool bpf_jit_supports_private_stack(void);
 bool bpf_jit_supports_large_stack(void);