[GIT PULL] bpf for 7.2-rc5

[GIT PULL] bpf for 7.2-rc5

[Eduard Zingerman]

Hi Linus,

The following changes since commit 94515f3a7d4256a5062176b7d6ed0471938cd51a:

  Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2026-07-17 12:55:24 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git tags/bpf-fixes

for you to fetch changes up to 2d66a033864e27ab8d5e44cb36f31d9d2413bee4:

  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (2026-07-24 15:04:11 -0700)

----------------------------------------------------------------
BPF fixes:

- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
  sk_psock->cork for the local temporary message and freeing it
  again. (Chengfeng Ye)

- Reject passing scalar NULL to nonnull arg of a global subprog.
  Previously the verifier did not account for the cases directly
  passing scalars to a global subprog, e.g.: 'global_func(0);'
  would pass even if 'global_func' argument was marked nonnull.
  (Amery Hung)

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

----------------------------------------------------------------
Amery Hung (2):
      bpf: Reject passing scalar NULL to nonnull arg of a global subprog
      selftests/bpf: Test passing scalar NULL to nonnull global subprog

Chengfeng Ye (1):
      bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

 kernel/bpf/verifier.c                                        |  3 ++-
 net/ipv4/tcp_bpf.c                                           |  2 +-
 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c | 10 ++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)