Kumar Kartikeya Dwivedi 7b7b8b5960 bpf: Reject resilient lock operations in rbtree callbacks ... __bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held throughout the callback. The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. Since resilient locks may protect BPF rbtree roots, a callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk. The walk then resumes using freed pointers. Reject resilient lock kfuncs in an rbtree comparison callback, matching the existing policy for the spin lock helpers. Resilient-lock-protected trees remain valid when their comparison callbacks leave lock state alone. Fixes: 0de2046137 ("bpf: Implement verifier support for rqspinlock") Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260903144433.1716731-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2026-09-03 09:44:52 -07:00
..
preload	umd: Remove usermode driver framework	2025-07-26 21:03:04 +02:00
arena.c	bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE	2026-08-06 10:58:04 +02:00
arraymap.c	bpf: Fix percpu map update indexing with sparse CPU IDs	2026-08-21 10:41:27 -07:00
backtrack.c	bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks	2026-09-02 11:13:21 -07:00
bloom_filter.c	bpf: Harden bloom filter sizing and indexing on 32-bit kernels	2026-08-05 11:45:20 -07:00
bpf_cgrp_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
bpf_inode_storage.c	bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized	2026-06-30 16:31:56 +02:00
bpf_insn_array.c	bpf: Lose const-ness of map in map_check_btf()	2026-02-27 15:39:00 -08:00
bpf_iter.c	bpf: Inline bpf_iter_num_destroy() as a no-op	2026-08-05 10:44:35 -07:00
bpf_local_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
bpf_lru_list.c	bpf: Fix NMI/tracepoint re-entry deadlock on lru locks	2026-06-07 18:46:13 -07:00
bpf_lru_list.h	bpf: Fix NMI/tracepoint re-entry deadlock on lru locks	2026-06-07 18:46:13 -07:00
bpf_lsm_proto.c	bpf: annotate file argument as __nullable in bpf_lsm_mmap_file	2025-12-21 10:56:33 -08:00
bpf_lsm.c	bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}	2026-08-03 00:29:14 +02:00
bpf_struct_ops.c	bpf: Support __arena and __arena__nullable on struct_ops arguments	2026-08-08 03:03:26 -07:00
bpf_task_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
btf_iter.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf_relocate.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf.c	bpf: Mark signal tracepoint siginfo arguments as scalar	2026-09-03 09:44:48 -07:00
cfg.c	bpf: Report Program Structure CFG errors	2026-08-15 11:15:17 -07:00
cgroup_iter.c	bpf: add new BPF_CGROUP_ITER_CHILDREN control option	2026-01-27 09:05:54 -08:00
cgroup.c	bpf: Reject negative optlen in cgroup getsockopt hook	2026-08-17 11:33:29 +02:00
check_btf.c	bpf: Rename 'early' BTF checking as a preparation phase	2026-08-08 03:03:25 -07:00
cnum_defs.h	bpf: Export cnum_umin/umax() helpers for netronome driver	2026-04-27 10:09:48 -07:00
cnum.c	bpf: representation and basic operations on circular numbers	2026-04-24 18:14:17 -07:00
const_fold.c	bpf: Introduce global percpu data	2026-08-13 10:27:40 -07:00
core.c	x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATA	2026-08-20 17:52:31 +02:00
cpumap.c	bpf: Add missing XDP_ABORTED handling in cpumap	2026-03-03 08:37:21 -08:00
cpumask.c	bpf: Require a BPF cpumask for bpf_cpumask_populate()	2026-07-12 01:52:36 +02:00
crypto.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
devmap.c	bpf: Run generic devmap egress prog on private skb	2026-06-12 18:21:01 -07:00
diagnostics.c	bpf: Preserve source attribution without source text	2026-08-17 11:58:23 +02:00
diagnostics.h	bpf: Report Policy helper and kfunc errors	2026-08-15 11:15:17 -07:00
disasm.c	bpf: Reject invalid LDSX instruction in disassembly	2026-08-20 18:45:44 +02:00
disasm.h
dispatcher.c	bpf: dispatcher: Allocate bpf_dispatcher->rw_image with vzalloc()	2026-07-22 17:26:39 +02:00
dmabuf_iter.c	bpf: Fix truncated dmabuf iterator reads	2025-12-09 23:48:34 -08:00
fixups.c	bpf: Rewrite any fault prone load out of a mem or btf_id pointer	2026-08-17 10:06:42 +02:00
hashtab.c	bpf: Reject key-less BTF for hash maps	2026-09-03 09:31:52 -07:00
helpers.c	bpf: Fix arm64 KASAN false positive after bpf_throw	2026-08-14 18:26:14 +02:00
inode.c	bpf-next-7.2	2026-06-17 09:18:14 +01:00
Kconfig	bpf: Update the bpf_prog_calc_tag to use SHA256	2025-09-18 19:10:20 -07:00
kmem_cache_iter.c	bpf: Add open coded version of kmem_cache iterator	2024-11-01 11:08:32 -07:00
link_iter.c	bpf: Clean up individual BTF_ID code	2025-07-16 18:34:42 -07:00
liveness.c	bpf: Drop duplicate blank lines in kernel/bpf/	2026-08-13 10:27:40 -07:00
local_storage.c	bpf: Fix percpu map update indexing with sparse CPU IDs	2026-08-21 10:41:27 -07:00
log.c	bpf: Track verifier register diagnostic events	2026-08-15 11:11:16 -07:00
lpm_trie.c	bpf: Allow LPM map access from sleepable BPF programs	2026-06-09 12:42:22 -07:00
Makefile	bpf: Add verifier diagnostics report helpers	2026-08-15 11:11:16 -07:00
map_in_map.c	bpf: Reject exclusive maps as inner maps in map-in-map	2026-06-01 18:36:40 -07:00
map_in_map.h	bpf: Add map and need_defer parameters to .map_fd_put_ptr()	2023-12-04 17:50:26 -08:00
map_iter.c	bpf: Implement iteration ops for resizable hashtab	2026-06-05 08:00:08 -07:00
memalloc.c	bpf: Retire rcu_trace_implies_rcu_gp()	2026-04-07 12:24:49 -07:00
mmap_unlock_work.h	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
mprog.c
net_namespace.c	bpf: Fix potential UAF in bpf_netns_link_update_prog	2026-07-30 15:28:46 -07:00
offload.c	bpf: Fix use-after-free in offloaded map/prog info fill	2026-04-09 13:24:32 -07:00
percpu_freelist.c	bpf: Fix infinite loop in pcpu_freelist push with one possible CPU	2026-08-20 20:44:16 +02:00
percpu_freelist.h	bpf: Fix infinite loop in pcpu_freelist push with one possible CPU	2026-08-20 20:44:16 +02:00
prog_iter.c	bpf: Clean up individual BTF_ID code	2025-07-16 18:34:42 -07:00
queue_stack_maps.c	bpf: Drop duplicate blank lines in kernel/bpf/	2026-08-13 10:27:40 -07:00
range_tree.c	bpf: arena: Reintroduce memcg accounting	2026-01-02 14:31:59 -08:00
range_tree.h	bpf: Introduce range_tree data structure and use it in bpf arena	2024-11-13 13:52:45 -08:00
relo_core.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
reuseport_array.c	bpf: Use sockfd_put() helper	2024-08-30 08:57:47 -07:00
ringbuf.c	bpf: Fix available-data accounting on 32-bit wrap in overwrite mode	2026-08-14 15:20:37 -07:00
rqspinlock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7	2026-08-07 23:04:17 +02:00
rqspinlock.h	rqspinlock: Protect waiters in queue from stalls	2025-03-19 08:03:05 -07:00
stackmap.c	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
states.c	bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO	2026-08-28 10:44:21 -07:00
stream.c	bpf: Add bpf_stream_print_stack stack dumping kfunc	2026-02-03 10:41:16 -08:00
syscall.c	bpf: Populate mmap-able array map memory lazily	2026-08-14 15:31:30 -07:00
sysfs_btf.c	Driver core changes for 6.17-rc1	2025-07-29 12:15:39 -07:00
task_iter.c	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
tcx.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
tnum.c	bpf: Simplify tnum_step()	2026-03-24 08:45:29 -07:00
token.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
trampoline.c	bpf: Make bpf_trampoline_multi_detach return void	2026-08-13 02:52:23 +02:00
verifier.c	bpf: Reject resilient lock operations in rbtree callbacks	2026-09-03 09:44:52 -07:00