Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Daniel Borkmann:

 - Fix BPF verifier to not affect subreg_def marks in its range
   propagation (Eduard Zingerman)

 - Fix a truncation bug in the BPF verifier's handling of
   coerce_reg_to_size_sx (Dimitar Kanaliev)

 - Fix the BPF verifier's delta propagation between linked registers
   under 32-bit addition (Daniel Borkmann)

 - Fix a NULL pointer dereference in BPF devmap due to missing rxq
   information (Florian Kauer)

 - Fix a memory leak in bpf_core_apply (Jiri Olsa)

 - Fix an UBSAN-reported array-index-out-of-bounds in BTF parsing for
   arrays of nested structs (Hou Tao)

 - Fix build ID fetching where memory areas backing the file were
   created with memfd_secret (Andrii Nakryiko)

 - Fix BPF task iterator tid filtering which was incorrectly using pid
   instead of tid (Jordan Rome)

 - Several fixes for BPF sockmap and BPF sockhash redirection in
   combination with vsocks (Michal Luczaj)

 - Fix riscv BPF JIT and make BPF_CMPXCHG fully ordered (Andrea Parri)

 - Fix riscv BPF JIT under CONFIG_CFI_CLANG to prevent the possibility
   of an infinite BPF tailcall (Pu Lehui)

 - Fix a build warning from resolve_btfids that bpf_lsm_key_free cannot
   be resolved (Thomas Weißschuh)

 - Fix a bug in kfunc BTF caching for modules where the wrong BTF object
   was returned (Toke Høiland-Jørgensen)

 - Fix a BPF selftest compilation error in cgroup-related tests with
   musl libc (Tony Ambardar)

 - Several fixes to BPF link info dumps to fill missing fields (Tyrone
   Wu)

 - Add BPF selftests for kfuncs from multiple modules, checking that the
   correct kfuncs are called (Simon Sundberg)

 - Ensure that internal and user-facing bpf_redirect flags don't overlap
   (Toke Høiland-Jørgensen)

 - Switch to use kvzmalloc to allocate BPF verifier environment (Rik van
   Riel)

 - Use raw_spinlock_t in BPF ringbuf to fix a sleep in atomic splat
   under RT (Wander Lairson Costa)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (38 commits)
  lib/buildid: Handle memfd_secret() files in build_id_parse()
  selftests/bpf: Add test case for delta propagation
  bpf: Fix print_reg_state's constant scalar dump
  bpf: Fix incorrect delta propagation between linked registers
  bpf: Properly test iter/task tid filtering
  bpf: Fix iter/task tid filtering
  riscv, bpf: Make BPF_CMPXCHG fully ordered
  bpf, vsock: Drop static vsock_bpf_prot initialization
  vsock: Update msg_count on read_skb()
  vsock: Update rx_bytes on read_skb()
  bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
  selftests/bpf: Add asserts for netfilter link info
  bpf: Fix link info netfilter flags to populate defrag flag
  selftests/bpf: Add test for sign extension in coerce_subreg_to_size_sx()
  selftests/bpf: Add test for truncation after sign extension in coerce_reg_to_size_sx()
  bpf: Fix truncation bug in coerce_reg_to_size_sx()
  selftests/bpf: Assert link info uprobe_multi count & path_size if unset
  bpf: Fix unpopulated path_size when uprobe_multi fields unset
  selftests/bpf: Fix cross-compiling urandom_read
  selftests/bpf: Add test for kfunc module order
  ...

diff --combined include/net/sock.h
index db29c39e19a737363dcc8a49a39f00659a881c2f,c87295f3476db23934d4fcbeabc7851c61ad2bc4..f29c14448938753799953be3b6231d2cc3d6ab02
--- 1/include/net/sock.h
--- 2/include/net/sock.h
+++ b/include/net/sock.h
@@@ -894,8 -894,6 +894,8 @@@ static inline void sk_add_bind_node(str
        hlist_for_each_entry_safe(__sk, tmp, list, sk_node)
  #define sk_for_each_bound(__sk, list) \
        hlist_for_each_entry(__sk, list, sk_bind_node)
 +#define sk_for_each_bound_safe(__sk, tmp, list) \
 +      hlist_for_each_entry_safe(__sk, tmp, list, sk_bind_node)
  
  /**
   * sk_for_each_entry_offset_rcu - iterate over a list at a given struct offset
@@@ -2717,6 -2715,11 +2717,11 @@@ static inline bool sk_is_stream_unix(co
        return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM;
  }
  
+ static inline bool sk_is_vsock(const struct sock *sk)
+ {
+       return sk->sk_family == AF_VSOCK;
+ }
+ 
  /**
   * sk_eat_skb - Release a skb if it is no longer needed
   * @sk: socket to eat this skb from

diff --combined net/core/filter.c
index bd0d08bf76bb8de39ca2ca89cda99a97c9b0a034,4e3f42cc6611990277a4e6c3128bb92bdd10e246..cb272b35d4842edd6a732c7a6d93cb1f08d142ea
--- 1/net/core/filter.c
--- 2/net/core/filter.c
+++ b/net/core/filter.c
@@@ -42,7 -42,7 +42,7 @@@
  #include <linux/errno.h>
  #include <linux/timer.h>
  #include <linux/uaccess.h>
 -#include <asm/unaligned.h>
 +#include <linux/unaligned.h>
  #include <linux/filter.h>
  #include <linux/ratelimit.h>
  #include <linux/seccomp.h>
@@@ -2438,9 -2438,9 +2438,9 @@@ out
  
  /* Internal, non-exposed redirect flags. */
  enum {
-       BPF_F_NEIGH     = (1ULL << 1),
-       BPF_F_PEER      = (1ULL << 2),
-       BPF_F_NEXTHOP   = (1ULL << 3),
+       BPF_F_NEIGH     = (1ULL << 16),
+       BPF_F_PEER      = (1ULL << 17),
+       BPF_F_NEXTHOP   = (1ULL << 18),
  #define BPF_F_REDIRECT_INTERNAL       (BPF_F_NEIGH | BPF_F_PEER | BPF_F_NEXTHOP)
  };
  
@@@ -2450,6 -2450,8 +2450,8 @@@ BPF_CALL_3(bpf_clone_redirect, struct s
        struct sk_buff *clone;
        int ret;
  
+       BUILD_BUG_ON(BPF_F_REDIRECT_INTERNAL & BPF_F_REDIRECT_FLAGS);
+ 
        if (unlikely(flags & (~(BPF_F_INGRESS) | BPF_F_REDIRECT_INTERNAL)))
                return -EINVAL;