Syzbot CI

Subject	bpf: Stack in arena and a verifier that joins states
Author	alexei.starovoitov@gmail.com
Date	2026-10-26 02:58:22 +0000 UTC
Version
Cc	alexei.starovoitov@gmail.com andrii@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com memxor@gmail.com

Name	Content [All]
[PATCH bpf 01/81] selftests/bpf: Remove tests for global data in arena	[Body]
[PATCH bpf 02/81] libbpf: Remove .arena.data	[Body]
[PATCH bpf 03/81] libbpf: Keep format strings of bpf_printk() in .rodata	[Body]
[PATCH bpf 04/81] selftests/bpf: Remove tests for arena access through numbers	[Body]
[PATCH bpf 05/81] bpf: Remove BPF_F_ARENA_SCALAR	[Body]
[PATCH bpf 06/81] bpf, x86: Remove r0_on_stack from fetching atomics in arena	[Body]
[PATCH bpf 07/81] bpf: One time slice of may_goto for a run of a prog	[Body]
[PATCH bpf 08/81] selftests/bpf: Test may_goto in a loop that calls a subprog that spins	[Body]
[PATCH bpf 09/81] bpf: Clear delta of a register that scalar evolution widens	[Body]
[PATCH bpf 10/81] selftests/bpf: Test that a widened register is not linked	[Body]
[PATCH bpf 11/81] selftests/bpf: Wait for the last maps of map_kptr to be freed	[Body]
[PATCH bpf 12/81] bpf: Don't widen a pointer to a buffer in scalar evolution	[Body]
[PATCH bpf 13/81] selftests/bpf: Test a loop that moves a pointer to a buffer	[Body]
[PATCH bpf 14/81] bpf: Fix a false verifier bug in the clamp of scalar evolution	[Body]
[PATCH bpf 15/81] selftests/bpf: Test induction variables that come back out of range	[Body]
[PATCH bpf 16/81] libbpf: Make arena 1 Gbyte when max_entries is not set	[Body]
[PATCH bpf 17/81] selftests/bpf: Test the default size of arena	[Body]
[PATCH bpf 18/81] bpf: Treat addr_space_cast of a pointer that is not in arena as a move	[Body]
[PATCH bpf 19/81] selftests/bpf: Test addr_space_cast of pointers that are not in arena	[Body]
[PATCH bpf 20/81] libbpf: Support .bss.addr_space.1 section	[Body]
[PATCH bpf 21/81] libbpf: Relocate pointers that are stored in arena	[Body]
[PATCH bpf 22/81] selftests/bpf: Test pointers in arena and .bss.addr_space.1	[Body]
[PATCH bpf 23/81] bpf: Introduce bpf register BPF_REG_ARENA_SP	[Body]
[PATCH bpf 24/81] bpf: Add stacks for programs to arena	[Body]
[PATCH bpf 25/81] bpf, x86: Add BPF_ATOMIC_LOCAL	[Body]
[PATCH bpf 26/81] bpf: Support BPF_REG_ARENA_SP in the verifier	[Body]
[PATCH bpf 27/81] bpf, x86: Support BPF_REG_ARENA_SP	[Body]
[PATCH bpf 28/81] bpf, arm64: Support BPF_REG_ARENA_SP	[Body]
[PATCH bpf 29/81] selftests/bpf: Add tests for BPF_REG_ARENA_SP	[Body]
[PATCH bpf 30/81] bpf: Add bpf_arena_memcmp() and bpf_arena_memcpy() kfuncs	[Body]
[PATCH bpf 31/81] bpf: Add bpf_alloc() and bpf_free() kfuncs	[Body]
[PATCH bpf 32/81] bpf: Count stack arguments of a static subprog from its code	[Body]
[PATCH bpf 33/81] selftests/bpf: Test static subprogs that don't take what BTF says	[Body]
[PATCH bpf 34/81] bpf: Let scalar evolution see loads from read-only maps	[Body]
[PATCH bpf 35/81] selftests/bpf: Test scalar evolution with a loop bound in .rodata	[Body]
[PATCH bpf 36/81] bpf: Helpers don't write through ARG_ANYTHING	[Body]
[PATCH bpf 37/81] selftests/bpf: Test scalar evolution with stack address as ARG_ANYTHING	[Body]
[PATCH bpf 38/81] bpf: Simplify (zext32 (zext32 x)) in scalar evolution	[Body]
[PATCH bpf 39/81] selftests/bpf: Test scalar evolution with a latch on a 32-bit copy	[Body]
[PATCH bpf 40/81] bpf: Keep the range of a packet pointer when a number >= 0 is added	[Body]
[PATCH bpf 41/81] selftests/bpf: Test range of a packet pointer after a number is added	[Body]
[PATCH bpf 42/81] bpf: Allow BPF_MAX_SUBPROGS targets of a read from a table of functions	[Body]
[PATCH bpf 43/81] bpf: Tell user space that a run of a prog was cut short	[Body]
[PATCH bpf 44/81] bpf: Mask the count of a 32-bit shift in scalar evolution	[Body]
[PATCH bpf 45/81] selftests/bpf: Expect the masked count of 32-bit shifts	[Body]
[PATCH bpf 46/81] bpf: Finish the insn in the state that maybe_fork_scalars() splits off	[Body]
[PATCH bpf 47/81] bpf: Add join of verifier states	[Body]
[PATCH bpf 48/81] bpf: Describe loops that scalar evolution cannot count exactly	[Body]
[PATCH bpf 49/81] selftests/bpf: Adjust tests to loops that are counted now	[Body]
[PATCH bpf 50/81] bpf: Add may_goto to the loops that the verifier marks	[Body]
[PATCH bpf 51/81] bpf: Check stack and count calls of recursive subprogs at run time	[Body]
[PATCH bpf 52/81] bpf: Add the main pass as a fixpoint over the control flow graph	[Body]
[PATCH bpf 53/81] bpf: Verify programs as a fixpoint over the control flow graph	[Body]
[PATCH bpf 54/81] bpf: Allow 24 arguments of static subprogs	[Body]
[PATCH bpf 55/81] selftests/bpf: Test a static subprog with 24 arguments	[Body]
[PATCH bpf 56/81] bpf: Bump MAX_CALL_FRAMES to 32	[Body]
[PATCH bpf 57/81] selftests/bpf: Test 32 and 33 call frames	[Body]
[PATCH bpf 58/81] bpf: Bump BPF_MAX_SUBPROGS to 1024	[Body]
[PATCH bpf 59/81] selftests/bpf: Make room in veristat for the stats of 1024 subprogs	[Body]
[PATCH bpf 60/81] bpf: Remove is_state_visited()	[Body]
[PATCH bpf 61/81] bpf: Remove precision tracking	[Body]
[PATCH bpf 62/81] bpf: Remove prune points, levels of state comparison and pop_stack()	[Body]
[PATCH bpf 63/81] bpf: Print 0 as the limit in the statistics line	[Body]
[PATCH bpf 64/81] bpf: Remove bpf_compute_scc()	[Body]
[PATCH bpf 65/81] bpf: Update comments about paths, pruning and explored states	[Body]
[PATCH bpf 66/81] bpf: Remove iter.depth	[Body]
[PATCH bpf 67/81] bpf: Remove leftovers of precision tracking and read marks	[Body]
[PATCH bpf 68/81] bpf: Track a pointer to one of a set of functions	[Body]
[PATCH bpf 69/81] bpf, docs: Rewrite verifier.rst	[Body]
[PATCH bpf 70/81] selftests/bpf: Adjust tests of precision tracking	[Body]
[PATCH bpf 71/81] selftests/bpf: Adjust tests of linked registers and spills	[Body]
[PATCH bpf 72/81] selftests/bpf: Adjust tests of pruning	[Body]
[PATCH bpf 73/81] selftests/bpf: Adjust tests of loops	[Body]
[PATCH bpf 74/81] selftests/bpf: Adjust tests of recursion	[Body]
[PATCH bpf 75/81] selftests/bpf: Adjust tests to the order of verification and to the log	[Body]
[PATCH bpf 76/81] selftests/bpf: Adjust tests of unprivileged progs	[Body]
[PATCH bpf 77/81] selftests/bpf: Test states that are not joined	[Body]
[PATCH bpf 78/81] selftests/bpf: Test progs that run out of budget	[Body]
[PATCH bpf 79/81] selftests/bpf: Test 'unwound' in bpf_prog_info	[Body]
[PATCH bpf 80/81] selftests/bpf: Test the stack in arena after recursion ran out of budget	[Body]
[PATCH bpf 81/81] selftests/bpf: Test callx of one of a set of functions	[Body]

Session 2026-10-26

1 Findings

ID (for dev)	f569eb50-607c-4207-942a-2d35386cd2b7
Status	finished
Triaged	OK [Log]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	00d2cdf1637e340e66fa30900363a35af12fabd8 [Config]		passed [Log]
[KASAN] Boot test: Base	00d2cdf1637e340e66fa30900363a35af12fabd8 [Config]		passed [Log]
[KASAN] Build Patched		00d2cdf1637e340e66fa30900363a35af12fabd8 [Config] [Log] [patched]	failed [Log]
finding kernel build error Log

Patches (81)

Series Summary

Sessions

Session 2026-10-26