Commit a13307e97d5c for kernel

commit a13307e97d5c54b65720bb71fa379960ded1e51a
Merge: 0150da6be1c7 7a3c0289c3c8
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Aug 7 08:08:57 2026 -0700

    Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

    Pull BPF fixes from Daniel Borkmann:

     - Fix BPF verifier to preserve full pointer state for commuted
       scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

     - Fix a use-after-free of request sockets in the BPF TCP iterator
       batching (Jose Fernandez)

     - Fix a use-after-free of sk_redir in the BPF sockmap send verdict
       path (Chengfeng Ye)

     - Fix a netns reference imbalance in the BPF conntrack kfuncs
       (Chengfeng Ye)

     - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
       digest truncation (Eric Biggers)

     - Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
       sk_protocol to make sure it is a full socket (Luxiao Xu)

     - Fix rqspinlock to reset the tail when preserving the queue
       on deadlock (Kumar Kartikeya Dwivedi)

    * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
      rqspinlock: Reset tail when preserving queue on deadlock
      bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
      fsverity: Fix silent truncation in bpf_get_fsverity_digest()
      fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
      bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
      bpf: Fix netns reference imbalance in conntrack kfuncs
      bpf, sockmap: Fix sk_redir use-after-free in send verdict
      selftests/bpf: Cover commuted pointer state propagation
      bpf: Propagate untrusted pointer state in commuted arithmetic
      bpf: Preserve pointer state for commuted arithmetic
      bpf: Simplify sanitize_err() signature