Commit 46806af187f4 for kernel

commit 46806af187f448b0d5481f284e7c900a57ee6a6d
Merge: d011f648a708 c8a8a68d3ab4
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Oct 29 08:10:23 2026 -1000

    Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

    Pull bpf fixes from Alexei Starovoitov:

     - Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that
       were added for rust-bpf in this merge window. We found a cleaner
       approach that does it on compiler side instead of kernel/libbpf. No
       released kernel has them (Alexei Starovoitov)

     - Fix bpf_send_signal_task() returning -EPERM when it is called from a
       kernel thread (Aditya Sharma)

     - Various fixes (Alexei Starovoitov):
         - Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix
           objtool warning during the build
         - Fix scalar evolution: clear delta of a widened register, don't
           widen a pointer to a buffer, don't clamp a register whose type
           changed in the loop, and reset the range of a clamped packet
           pointer
         - Finish the insn in the state that maybe_fork_scalars() splits
           off, so that pruning doesn't drop it at the head of a counted
           loop
         - Preserve the registers that carry stack arguments across
           arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64
         - Don't re-sort subprog_info[] for every new subprogram
         - Fix flaky map_kptr and rcu_reentry selftests

     - Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()
       and bpf_xdp_load_bytes(), since the destination can be a slice of the
       same packet (Ayushman Rout)

     - Fixes and follow-ups for scalar evolution: reject pointer operands in
       32-bit recurrences and latches, don't intersect with the current
       register range on clamp to avoid a false 'verifier bug', avoid false
       infinite loop reports, and recognize a 32-bit copy of the induction
       variable (Eduard Zingerman)

     - Fix out-of-bounds write to btf->types[] for split BTF and propagate
       btf_add_type() errors in btf_check_all_metas() (Feng Yang)

     - Fix use-after-free in bpf_timer callback that fires after its inner
       map was freed (Mani Tofigh)

     - Fix x86 JIT stopping before jumps converge: size backward jumps by
       the insns they jump over (Mykyta Yatsenko)

     - Fix use-after-free of struct_ops trampoline: dissociate struct_ops
       progs before the grace period of the map (Qiliang Yuan)

     - Validate stack argument reads against the caller state to fix
       out-of-bounds read in the verifier, and reject callbacks with stack
       arguments (Weiming Shi)

     - Tie borrowed iterator results and pointers loaded from trusted fields
       to the lifetime of their source, so that iterator next, destroy and
       reference release invalidate them (Xu Yunxiang)

    * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)
      bpf: Don't re-sort subprog_info[] for every new subprogram
      bpf: Fix out-of-bounds btf->types write for split BTF
      selftests/bpf: Test stack arguments across may_goto
      bpf: Keep stack arguments in arch_bpf_timed_may_goto()
      selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop
      bpf: Finish the insn in the state that maybe_fork_scalars() splits off
      selftests/bpf: Test the clamp of pointers in scalar evolution
      bpf: Reset the range of a packet pointer that scalar evolution clamps
      bpf: Don't clamp a register whose type changed in the loop
      selftests/bpf: Test a loop that moves a pointer to a buffer
      bpf: Don't widen a pointer to a buffer in scalar evolution
      selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed
      selftests/bpf: Wait for the last maps of map_kptr to be freed
      selftests/bpf: Test that a widened register is not linked
      bpf: Clear delta of a register that scalar evolution widens
      bpf, x86: Remove r0_on_stack from fetching atomics in arena
      bpf: Remove BPF_F_ARENA_SCALAR
      selftests/bpf: Remove tests for arena access through numbers
      libbpf: Keep format strings of bpf_printk() in .rodata
      libbpf: Remove .arena.data
      ...