[GIT PULL] BPF fixes for 7.2-rc4

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

Hi Linus,

The following changes since commit 2c7c88a412aa6d09cd04b414211b4ef8553b5309:

  Merge tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-09 08:26:51 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to 3d84d674e3a5a33ce5eaa14b92bc839c3821a348:

  Merge branch 'bpf-fix-tracing-of-kfuncs-with-implicit-args' (2026-07-16 16:11:30 -0700)

----------------------------------------------------------------
BPF fixes:

- Fix a UAF in socket clone early bailout paths (Matt Bobrowski)

- Reject unhashed UDP sockets on sockmap update to prevent refcount leaks
  (Michal Luczaj)

- Account for receive queue data in FIONREAD on sockmap sockets without a
  verdict program (Mattia Meleleo)

- Reject negative constant offsets for verifier buffer pointers (Sun Jian)

- Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
----------------------------------------------------------------
Eduard Zingerman (2):
      Merge branch 'bpf-reject-negative-const-offsets-for-buffer-pointers'
      Merge branch 'bpf-fix-tracing-of-kfuncs-with-implicit-args'

Ihor Solodrai (1):
      bpf: Fix tracing of kfuncs with implicit args

Kumar Kartikeya Dwivedi (3):
      Merge branch 'bpf-sockmap-fix-sockmap-leaking-udp-socks'
      Merge branch 'bpf-sockmap-fix-fionread-for-sockets-without-a-verdict-program'
      selftests/bpf: Cover tracing implicit kfunc args

Matt Bobrowski (1):
      bpf: Fix UAF in sock clone early bailouts

Mattia Meleleo (2):
      bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
      selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program

Michal Luczaj (4):
      selftests/bpf: Ensure UDP sockets are bound
      bpf, sockmap: Reject unhashed UDP sockets on sockmap update
      selftests/bpf: Adapt sockmap update error handling
      selftests/bpf: Fail unbound UDP on sockmap update

Sun Jian (2):
      bpf: Reject negative const offsets for buffer pointers
      selftests/bpf: Cover negative buffer pointer offsets

 include/linux/btf.h                                                         |  1 +
 include/linux/skmsg.h                                                       | 14 -----------
 kernel/bpf/btf.c                                                            | 29 +++++++++++++++++++++++
 kernel/bpf/verifier.c                                                       | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------------
 net/core/bpf_sk_storage.c                                                   |  2 --
 net/core/sock.c                                                             |  3 +++
 net/core/sock_map.c                                                         |  2 ++
 net/ipv4/tcp_bpf.c                                                          | 17 +++++++++++++-
 tools/testing/selftests/bpf/prog_tests/kfunc_implicit_args_tracing.c        | 36 ++++++++++++++++++++++++++++
 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_bad_access.c  | 57 +++++++++++++++++++++++++++++++++++++++++++++
 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_nbd_invalid.c | 43 ----------------------------------
 tools/testing/selftests/bpf/prog_tests/sockmap_basic.c                      | 45 ++++++++++++++++++++++++++++++++---
 tools/testing/selftests/bpf/prog_tests/sockmap_listen.c                     | 21 +++++++++--------
 tools/testing/selftests/bpf/prog_tests/verifier.c                           |  2 ++
 tools/testing/selftests/bpf/progs/kfunc_implicit_args_tracing.c             | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 tools/testing/selftests/bpf/progs/verifier_ptr_to_buf.c                     | 27 +++++++++++++++++++++
 tools/testing/selftests/bpf/progs/verifier_raw_tp_writable.c                | 16 +++++++++++++
 tools/testing/selftests/bpf/test_maps.c                                     | 13 +++++------
 18 files changed, 397 insertions(+), 105 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/kfunc_implicit_args_tracing.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_bad_access.c
 delete mode 100644 tools/testing/selftests/bpf/prog_tests/raw_tp_writable_reject_nbd_invalid.c
 create mode 100644 tools/testing/selftests/bpf/progs/kfunc_implicit_args_tracing.c
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_ptr_to_buf.c