[GIT PULL] bpf for v6.14-rc4

[Daniel Borkmann]

Hi Linus,

The following changes since commit 05dbaf8dd8bf537d4b4eb3115ab42a5fb40ff1f5:

  Merge tag 'x86-urgent-2025-01-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip (2025-01-28 14:32:03 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to dbf7cc560007c8624ba42bbda369eca2973fc2da:

  Merge branch 'bpf-skip-non-exist-keys-in-generic_map_lookup_batch' (2025-02-18 17:27:38 -0800)

----------------------------------------------------------------
BPF fixes:

- Fix a soft-lockup in BPF arena_map_free on 64k page size
  kernels (Alan Maguire)

- Fix a missing allocation failure check in BPF verifier's
  acquire_lock_state (Kumar Kartikeya Dwivedi)

- Fix a NULL-pointer dereference in trace_kfree_skb by adding
  kfree_skb to the raw_tp_null_args set (Kuniyuki Iwashima)

- Fix a deadlock when freeing BPF cgroup storage (Abel Wu)

- Fix a syzbot-reported deadlock when holding BPF map's
  freeze_mutex (Andrii Nakryiko)

- Fix a use-after-free issue in bpf_test_init when
  eth_skb_pkt_type is accessing skb data not containing an
  Ethernet header (Shigeru Yoshida)

- Fix skipping non-existing keys in generic_map_lookup_batch
  (Yan Zhai)

- Several BPF sockmap fixes to address incorrect TCP copied_seq
  calculations, which prevented correct data reads from recv(2)
  in user space (Jiayuan Chen)

- Two fixes for BPF map lookup nullness elision (Daniel Xu)

- Fix a NULL-pointer dereference from vmlinux BTF lookup in
  bpf_sk_storage_tracing_allowed (Jared Kangas)

Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>

----------------------------------------------------------------
Abel Wu (1):
      bpf: Fix deadlock when freeing cgroup storage

Alan Maguire (1):
      bpf: Fix softlockup in arena_map_free on 64k page kernel

Alexei Starovoitov (2):
      Merge branch 'bpf-some-fixes-for-nullness-elision'
      Merge branch 'bpf-skip-non-exist-keys-in-generic_map_lookup_batch'

Andrii Nakryiko (2):
      bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
      bpf: avoid holding freeze_mutex during mmap operation

Daniel Xu (3):
      bpf: verifier: Do not extract constant map keys for irrelevant maps
      bpf: selftests: Test constant key extraction on irrelevant maps
      bpf: verifier: Disambiguate get_constant_map_key() errors

Jared Kangas (1):
      bpf: Remove unnecessary BTF lookups in bpf_sk_storage_tracing_allowed

Jiayuan Chen (5):
      strparser: Add read_sock callback
      bpf: Fix wrong copied_seq calculation
      bpf: Disable non stream socket for strparser
      selftests/bpf: Fix invalid flag of recv()
      selftests/bpf: Add strparser test for bpf

Kumar Kartikeya Dwivedi (1):
      bpf: Handle allocation failure in acquire_lock_state

Kuniyuki Iwashima (1):
      net: Add rx_skb of kfree_skb to raw_tp_null_args[].

Martin KaFai Lau (1):
      Merge branch 'bpf-fix-wrong-copied_seq-calculation-and-add-tests'

Shigeru Yoshida (2):
      bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
      selftests/bpf: Adjust data size to have ETH_HLEN

Yan Zhai (2):
      bpf: skip non exist keys in generic_map_lookup_batch
      selftests: bpf: test batch lookup on array of maps with holes

 Documentation/networking/strparser.rst             |   9 +-
 include/linux/skmsg.h                              |   2 +
 include/net/strparser.h                            |   2 +
 include/net/tcp.h                                  |   8 +
 kernel/bpf/arena.c                                 |   2 +-
 kernel/bpf/bpf_cgrp_storage.c                      |   2 +-
 kernel/bpf/btf.c                                   |   2 +
 kernel/bpf/ringbuf.c                               |   4 -
 kernel/bpf/syscall.c                               |  43 +-
 kernel/bpf/verifier.c                              |  31 +-
 net/bpf/test_run.c                                 |   5 +-
 net/core/bpf_sk_storage.c                          |  13 +-
 net/core/skmsg.c                                   |   7 +
 net/core/sock_map.c                                |   5 +-
 net/ipv4/tcp.c                                     |  29 +-
 net/ipv4/tcp_bpf.c                                 |  36 ++
 net/strparser/strparser.c                          |  11 +-
 .../selftests/bpf/map_tests/map_in_map_batch_ops.c |  62 ++-
 .../selftests/bpf/prog_tests/sockmap_basic.c       |  59 +--
 .../selftests/bpf/prog_tests/sockmap_strp.c        | 454 +++++++++++++++++++++
 .../selftests/bpf/prog_tests/xdp_cpumap_attach.c   |   4 +-
 .../selftests/bpf/prog_tests/xdp_devmap_attach.c   |   8 +-
 .../selftests/bpf/progs/test_sockmap_strp.c        |  53 +++
 .../selftests/bpf/progs/verifier_array_access.c    |  15 +
 24 files changed, 726 insertions(+), 140 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/sockmap_strp.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_strp.c