Merge branch 'bpf-fixes-for-unwind_goto-and-unwind_exit'

Alexei Starovoitov says:

====================
bpf: Fixes for unwind_goto and unwind_exit

From: Alexei Starovoitov <ast@kernel.org>

Two fixes for what the bots found in v4 [1] of the series that added
unwind_goto and unwind_exit.

Patch 1. unwind_exit of an exception callback is exit for the verifier, but
JITs looked up the return address. The callback returns from the frame of
the main prog. After freplace or a tail call that's a return to a prog, and
the callback could end up in a pad that wasn't verified with it.
It came with 'unwind_exit of an async or an exception callback is exit' in
v4. For an async callback that's fine: it has a frame of its own.

Patch 2. Offloaded progs with the new insns are rejected.

Patch 3. Tests for patch 1. They fail without it.

[1] https://lore.kernel.org/bpf/20261020181320.1284798-1-alexei.starovoitov@gmail.com/
====================

Link: https://patch.msgid.link/20261020231942.2568163-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>