Commit 8f150ccedfbd for kernel

commit 8f150ccedfbd610aa25509ff42365d70fb20478f
Merge: d2dbe503fd80 de020dc8049b
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Oct 2 12:59:32 2026 -0700

    Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

    Pull bpf fixes from Alexei Starovoitov:

     - Fix overflow of backward jump offset in constant blinding
       (Alexei Starovoitov)

     - Fix packet range of packet pointers sharing an id when var_off
       tightens umax of one pointer and not the other (Alexei Starovoitov)

     - Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc
       (Alexei Starovoitov)

     - Fix use-after-free of progs detached from busy trampolines: wait for
       an RCU tasks grace period before freeing trampoline progs, and patch
       detached progs out of trampoline images that are still in use
       (Florent Revest)

     - Hold map BTF for the memory allocator destructor record to fix UAF in
       deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi)

     - Fix missing migration protection in resizable hashtab
       lookup_and_delete batch operation (Ömer Mete Kaya)

    * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
      bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
      selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace
      bpf: Fix objects stuck in free_by_rcu_ttrace
      bpf: Factor out __do_call_rcu_ttrace()
      selftests/bpf: Test packet range of pointers sharing an id
      bpf: Fix packet range of pointers sharing an id
      selftests/bpf: Detach a trampoline prog while a task sleeps before it
      bpf: Skip detached progs in trampoline images that are still in use
      bpf: Wait for an RCU tasks grace period before freeing trampoline progs
      bpf: Hold map BTF for the memory allocator destructor record
      bpf: Fix overflow of jump offset in constant blinding