[GIT PULL] bpf for v7.2-rc7

[Daniel Borkmann <daniel@iogearbox.net>]

Hi Linus,

The following changes since commit 0ce37745d4bfbc493f718169c3974898ffec8ee7:

  Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux (2026-07-24 20:02:58 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to 7a3c0289c3c8eb4607dff448ae9ff9f902c813af:

  rqspinlock: Reset tail when preserving queue on deadlock (2026-08-06 16:32:42 -0700)

----------------------------------------------------------------
BPF fixes:

- Fix BPF verifier to preserve full pointer state for commuted
  scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

- Fix a use-after-free of request sockets in the BPF TCP
  iterator batching (Jose Fernandez)

- Fix a use-after-free of sk_redir in the BPF sockmap send
  verdict path (Chengfeng Ye)

- Fix a netns reference imbalance in the BPF conntrack kfuncs
  (Chengfeng Ye)

- Fix bpf_get_fsverity_digest() dynptr assumptions and silent
  digest truncation (Eric Biggers)

- Fix bpf_tcp_{gen,check}_syncookie to check sk_state before
  sk_protocol to make sure it is a full socket (Luxiao Xu)

- Fix rqspinlock to reset the tail when preserving the queue
  on deadlock (Kumar Kartikeya Dwivedi)

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

----------------------------------------------------------------
Chengfeng Ye (2):
      bpf, sockmap: Fix sk_redir use-after-free in send verdict
      bpf: Fix netns reference imbalance in conntrack kfuncs

Eduard Zingerman (2):
      bpf: Simplify sanitize_err() signature
      Merge branch 'bpf-preserve-pointer-state-for-commuted-arithmetic'

Eric Biggers (2):
      fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
      fsverity: Fix silent truncation in bpf_get_fsverity_digest()

Jose Fernandez (Anthropic) (1):
      bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

Kumar Kartikeya Dwivedi (2):
      Merge branch 'fixes-for-bpf_get_fsverity_digest'
      rqspinlock: Reset tail when preserving queue on deadlock

Luxiao Xu (1):
      bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

Yiyang Chen (3):
      bpf: Preserve pointer state for commuted arithmetic
      bpf: Propagate untrusted pointer state in commuted arithmetic
      selftests/bpf: Cover commuted pointer state propagation

 fs/verity/measure.c                                | 15 +++--
 kernel/bpf/rqspinlock.c                            |  5 +-
 kernel/bpf/verifier.c                              | 45 +++++++-------
 net/core/filter.c                                  |  4 +-
 net/ipv4/tcp_bpf.c                                 |  2 +
 net/ipv4/tcp_ipv4.c                                | 43 +++++++------
 net/netfilter/nf_conntrack_bpf.c                   | 72 ++++++++++++++--------
 tools/testing/selftests/bpf/progs/dynptr_fail.c    | 30 +++++++++
 .../selftests/bpf/progs/mem_rdonly_untrusted.c     | 17 +++++
 .../selftests/bpf/progs/verifier_basic_stack.c     | 41 ++++++++++++
 10 files changed, 198 insertions(+), 76 deletions(-)