[GIT PULL] BPF fixes for 7.2-rc2

[Daniel Borkmann]

Hi Linus,

The following changes since commit 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4:

  Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2026-06-25 14:09:26 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to b72e29e0f7ee329d89f86db8700c8ea99b4a370a:

  bpf: Prefer dirty packs for eBPF allocations (2026-07-01 10:34:41 +0200)

----------------------------------------------------------------
BPF fixes:

- Initialize task local storage before fork bails out to
  free the task (Jann Horn)

- Fix insn_aux_data leak on verifier error path (KaFai Wan)

- Reject BPF inode storage map creation when BPF LSM is
  uninitialized (Matt Bobrowski)

- Mask pseudo pointer values in verifier logs when pointer
  leaks are not allowed (Nuoqi Gui)

- Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)

- Reject a skb-modifying SK_SKB stream parser since the latter
  is only meant to measure the next message (Sechang Lim)

- Fix bpf_refcount_acquire to reject refcounted allocation
  arguments with a non-zero fixed offset (Yiyang Chen)

Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>

----------------------------------------------------------------
Alexei Starovoitov (3):
      Merge branch 'bpf-sockmap-reject-a-packet-modifying-sk_skb-stream-parser'
      Merge branch 'bpf-reject-offset-refcount-acquire-arguments'
      Merge branch 'bpf-mask-pseudo-pointer-values-in-verifier-logs'

Jann Horn (1):
      bpf,fork: wipe ->bpf_storage before bailouts that access it

KaFai Wan (1):
      bpf: Fix insn_aux_data leak on verifier err_free_env path

Matt Bobrowski (1):
      bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

Nuoqi Gui (2):
      bpf: Mask pseudo pointer values in verifier logs
      selftests/bpf: Cover pseudo-BTF ksym log masking

Pawan Gupta (6):
      bpf: Support for hardening against JIT spraying
      x86/bugs: Enable IBPB flush on BPF JIT allocation
      bpf: Restrict JIT predictor flush to cBPF
      bpf: Skip redundant IBPB in pack allocator
      bpf: Prefer packs that won't trigger an IBPB flush on allocation
      bpf: Prefer dirty packs for eBPF allocations

Sechang Lim (3):
      selftests/bpf: don't modify the skb in the strparser parser prog
      bpf, sockmap: reject a packet-modifying SK_SKB stream parser
      selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser

Yiyang Chen (2):
      bpf: Reject offset refcount acquire arguments
      selftests/bpf: Cover refcount acquire node offsets

 arch/arm64/net/bpf_jit_comp.c                      |  4 +-
 arch/loongarch/net/bpf_jit.c                       |  5 +-
 arch/powerpc/net/bpf_jit_comp.c                    |  4 +-
 arch/riscv/net/bpf_jit_comp64.c                    |  2 +-
 arch/riscv/net/bpf_jit_core.c                      |  3 +-
 arch/x86/include/asm/nospec-branch.h               |  4 ++
 arch/x86/kernel/cpu/bugs.c                         | 50 ++++++++++++++--
 arch/x86/net/bpf_jit_comp.c                        |  5 +-
 include/linux/bpf_lsm.h                            |  4 ++
 include/linux/filter.h                             | 15 ++++-
 kernel/bpf/bpf_inode_storage.c                     |  9 +++
 kernel/bpf/core.c                                  | 68 ++++++++++++++++++++--
 kernel/bpf/disasm.c                                |  5 +-
 kernel/bpf/dispatcher.c                            |  2 +-
 kernel/bpf/verifier.c                              | 34 +++++++----
 kernel/fork.c                                      |  9 +--
 net/core/sock_map.c                                | 20 +++++++
 security/bpf/hooks.c                               |  3 +
 .../selftests/bpf/prog_tests/sockmap_strp.c        | 31 ++++++++++
 .../selftests/bpf/progs/refcounted_kptr_fail.c     | 34 +++++++++++
 .../selftests/bpf/progs/sockmap_parse_prog.c       | 22 -------
 .../selftests/bpf/progs/test_sockmap_strp.c        |  7 +++
 .../testing/selftests/bpf/progs/verifier_unpriv.c  | 19 ++++++
 23 files changed, 297 insertions(+), 62 deletions(-)