Commit 2beb1b31a12b for kernel

commit 2beb1b31a12b57e19cd5c82ea6d54e56520605e8
Merge: 88405f0ad1d5 536b523b4073
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Sep 6 13:49:44 2026 -0700

    Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

    Pull bpf fixes from Alexei Starovoitov:
     "This mainly contains verifier fixes that address bugs reported by
      Nicholas Carlini.

       - Fix incorrect non-NULL inference in pointer comparisons: pointer
         types that may be NULL at runtime, pointers with unbounded offsets,
         JMP32 comparisons with zero, and imprecise zero registers (Eduard
         Zingerman)

       - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
         implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
         NULL call arguments (Eduard Zingerman)

       - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
         extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
         patterns entered by a jump (Eduard Zingerman)

       - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
         (Hui Su)

       - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
         and reject key-less BTF for hash maps (Jiayuan Chen)

       - Various fixes (Kumar Kartikeya Dwivedi):
           - Fix out-of-bounds access in disassembler on invalid LDSX
             instruction
           - mark siginfo of signal tracepoints as scalar and
             sched_process_wait argument as nullable
           - mark faultable stack helpers as sleepable
           - reject tail calls and legacy packet loads from callbacks
           - enforce rbtree callback lock restrictions for resilient locks
           - require MEM_PERCPU for percpu kptr stores
           - clear NON_OWN_REF after RCU protection ends
           - mark NULL kptr stores precise
           - preserve inner map identity in callback frames
           - reject non-scalar bpf_loop() iteration counts

       - Fix trampoline allocation slowdown on x86 by using
         EXECMEM_MODULE_DATA (Mike Rapoport)

       - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
         reject untrusted allocated-object pointers (Ning Ding)

       - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
         Yuan Chen)"

    * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
      bpf, riscv: Make arena support depend on ZACAS
      selftests/bpf: Test pointer bpf_loop iteration count rejection
      bpf: Reject non-scalar bpf_loop iteration counts
      bpf: use mark_arg_precision() in check_mem_size_reg()
      bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
      selftests/bpf: precision of a NULL global subprogram BTF_ID argument
      bpf: mark a NULL BTF_ID argument of a global subprogram precise
      selftests/bpf: precision of a NULL kfunc argument
      bpf: mark a NULL kfunc argument precise
      selftests/bpf: precision of a NULL global subprogram memory argument
      bpf: mark a NULL memory argument of a call precise
      selftests/bpf: precision of a NULL helper argument
      bpf: mark a NULL call argument precise
      selftests/bpf: Test inner map identities in callbacks
      bpf: Preserve inner map identity in callback frames
      selftests/bpf: Test imprecise scalar kptr stores
      bpf: Mark NULL kptr stores precise
      selftests/bpf: Test rhtab kptr cancellation semantics
      bpf: Cancel special fields when recycling rhtab elements
      selftests/bpf: Test timer field on recycled rhtab element
      ...