Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
 "Fix various bugs in bpf core and bpf-lwt. Looks like the speed of us
  fixing bugs is higher than the number of new bugs found. Not out of
  the woods yet. sockmap fixes will come later.

   - Various fixes (Alexei Starovoitov):
       - Use one may_goto time slice per prog invocation instead of one
         per stack frame to fix a soft lockup in loops that nest across
         calls
       - Fix use-after-free in btf__add_type() in libbpf
       - Invalidate a dynptr slice when its stack buffer is written or
         when the frame of the buffer returns
       - Fix the tracking of pointers to the stack in SCEV
       - Keep the valid bytes of a packet pointer in SCEV
       - Fix bpf_throw() in a prog with a private stack in x86 JIT
       - Compare the arguments of an extension prog with those of its
         target
       - Don't accept memory of the prog for struct arguments of
         KF_ACQUIRE kfuncs and for arguments of an empty struct type
       - Fix mmap() of an arena: refuse address 0 and a length above
         max_entries pages, etc.
       - Don't let bpf_skb_adjust_room() raise gso_size to GSO_BY_FRAGS
       - Fix lwt progs: reset skb->cb and don't leave a stale MAC header
         after a prog pushes an IP header, require BPF_LWT_REROUTE when
         an lwt_in prog changes the protocol, don't call into IPv6 when
         it is disabled, don't look for the SRH again in the End.BPF
         helpers, and set a dst for test runs of lwt_in progs

   - Fix bpf_dynptr_copy() for overlapping ranges in one packet
     (Ayushman Rout)

   - Various fixes (Chris Mason):
       - Reject memory of the prog for kfunc projection type arguments
       - Require prog fd or capability for cgroup prog detach
       - Keep the skb network offset signed in cgroup skb progs
       - Reject non-IPv6 packets in BPF_LWT_ENCAP_SEG6
       - Limit the SRH length and move the MAC header in
         bpf_lwt_seg6_adjust_srh()
       - Move the transport header together with the headers that
         bpf_skb_adjust_room() and bpf_lwt_seg6_adjust_srh() move, and
         use the inner transport header after a decap
       - Check the offset in bpf_skb_generic_{push,pop}()

   - Mark jmp mode of ftrace direct trampolines on x86 by clearing bit
     63 of the address instead of setting bit 0, since an ftrace
     callback can start at an odd address (Daniel Borkmann)

   - Fix psock update-side data races on sk->sk_prot and progs in
     sockmap (Jakub Sitnicki)

   - Fix skb_pull() BUG in __bpf_redirect_neigh(): make sure that the
     MAC and IP headers are there and are linear (Jamal Hadi Salim)

   - Fix jited line info that is off by the CFI preamble on x86-64,
     arm64 and riscv64 (Jose Fernandez)

   - Clamp the trace length in __bpf_get_stack() to fix a write after
     the end of the buffer (Josef Bacik)

   - Drop percpu_counter from the htab element count, since its lock can
     deadlock with NMI and tracing progs that update the same map
     (Puranjay Mohan)

   - Propagate scalar precision through stack arguments (Xu Yunxiang)

   - Fix callback recursion selftest with llvm24 (Yonghong Song)

   - Free the skb when bpf_xmit() fails to expand the headroom (Yuqiang
     Sun)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (61 commits)
  libbpf: Fix use-after-free in btf__add_type
  selftests/bpf: Exercise stack argument precision on state reuse
  bpf: Propagate scalar precision through stack arguments
  selftests/bpf: Fix callback recursion test with noipa global func
  selftests/bpf: Test one may_goto time slice per prog invocation
  bpf: End bpf_loop() when the time of may_goto is up
  bpf: One may_goto time slice per prog invocation
  bpf: Pass a pointer to arch_bpf_timed_may_goto()
  s390/bpf: Support internal-only MOV instruction to resolve per-CPU addrs
  selftests/bpf: End the loop of parallel_test_bitmap after 50 ms
  selftests/bpf: Give the first loop of cond_break5 an end
  selftests/bpf: Don't cast a pointer to .bss in arena_htab_asm
  bpf: Emit timed may_goto for JITed progs only
  selftests/bpf: Test writes to the buffer of bpf_dynptr_slice_rdwr()
  bpf: Invalidate a dynptr slice when its stack buffer is written
  selftests/bpf: Test a callee that overwrites a spilled pointer of its caller
  bpf: Don't trust pointers spilled in slots that a callee can write
  selftests/bpf: Test the join of fp+0 with a value that is not a pointer to stack
  bpf: Fix the join of fp+0 with a value that is not a pointer to stack
  selftests/bpf: Run arena_mmap serially and test MAP_FIXED addresses
  ...

0 files changed, 0 insertions, 0 deletions