Changes in rhash_timer.c

2beb1b31a12b57e19cd5c82ea6d54e56520605e8 - Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Sun, 06 Sep 2026 22:49:44 +0200

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfPull bpf fixes from Alexei Starovoitov: "This mainly contains verifier fixes that address bugs reported by Nicholas Carlini. - Fix incorrect non-NULL inference in pointer comparisons: pointer types that may be NULL at runtime, pointers with unbounded offsets, JMP32 comparisons with zero, and imprecise zero registers (Eduard Zingerman) - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind implicit subprog exit, bpf_loop() callbacks, linked scalar ids and NULL call arguments (Eduard Zingerman) - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall patterns entered by a jump (Eduard Zingerman) - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs (Hui Su) - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types, and reject key-less BTF for hash maps (Jiayuan Chen) - Various fixes (Kumar Kartikeya Dwivedi): - Fix out-of-bounds access in disassembler on invalid LDSX instruction - mark siginfo of signal tracepoints as scalar and sched_process_wait argument as nullable - mark faultable stack helpers as sleepable - reject tail calls and legacy packet loads from callbacks - enforce rbtree callback lock restrictions for resilient locks - require MEM_PERCPU for percpu kptr stores - clear NON_OWN_REF after RCU protection ends - mark NULL kptr stores precise - preserve inner map identity in callback frames - reject non-scalar bpf_loop() iteration counts - Fix trampoline allocation slowdown on x86 by using EXECMEM_MODULE_DATA (Mike Rapoport) - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and reject untrusted allocated-object pointers (Ning Ding) - Fix special fields handling in recycled rhtab elements (Nuoqi Gui, Yuan Chen)"* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits) bpf, riscv: Make arena support depend on ZACAS selftests/bpf: Test pointer bpf_loop iteration count rejection bpf: Reject non-scalar bpf_loop iteration counts bpf: use mark_arg_precision() in check_mem_size_reg() bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() selftests/bpf: precision of a NULL global subprogram BTF_ID argument bpf: mark a NULL BTF_ID argument of a global subprogram precise selftests/bpf: precision of a NULL kfunc argument bpf: mark a NULL kfunc argument precise selftests/bpf: precision of a NULL global subprogram memory argument bpf: mark a NULL memory argument of a call precise selftests/bpf: precision of a NULL helper argument bpf: mark a NULL call argument precise selftests/bpf: Test inner map identities in callbacks bpf: Preserve inner map identity in callback frames selftests/bpf: Test imprecise scalar kptr stores bpf: Mark NULL kptr stores precise selftests/bpf: Test rhtab kptr cancellation semantics bpf: Cancel special fields when recycling rhtab elements selftests/bpf: Test timer field on recycled rhtab element ... List of files: /linux/tools/testing/selftests/bpf/progs/rhash_timer.c

519f858317afc52e986817ad63fd68172dd38b6c - Merge branch 'misc-bug-fixes-part-4'

Fri, 04 Sep 2026 21:24:25 +0200

Merge branch 'misc-bug-fixes-part-4'Kumar Kartikeya Dwivedi says:====================Misc bug fixes - part 4A set of miscellaneous fixes for bugs reported by Nicholas, and GPT-5.6when analyzing those fixes, batched together again. See commit logs fordetails. Related rhtab fixes from Yuan Chen and Nuoqi Gui have beenfolded into the series.====================Link: https://patch.msgid.link/20260904104203.345917-1-memxor@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/rhash_timer.c

dbf6806dc81553edbab72fcec9a6d637dedff2f4 - selftests/bpf: Test timer field on recycled rhtab element

Fri, 04 Sep 2026 12:41:53 +0200

selftests/bpf: Test timer field on recycled rhtab elementExercise the rhtab special-field lifecycle with the sequence from theoriginal report. A bpf_for_each_map_elem() callback deletes the soleelement, then initializes and arms a timer through the callback valuepointer while it remains valid.Use a one-element map and pin userspace and BPF execution to one CPU.Repeated delete-and-replace cycles drain the per-CPU allocator cache, andperiodic RCU synchronization makes the deleted units available forrecycling.After each replacement, a second BPF program calls bpf_timer_cancel()on its value. A successful cancellation proves both that a timer-bearingunit was recycled and that insertion preserved the timer field. Withoutthe fix, insertion clears that field and cancellation keeps returning-EINVAL. A long expiration keeps the timer callback out of the test, sothe regression is detected without accessing freed memory.Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904104203.345917-3-memxor@gmail.comSigned-off-by: Alexei Starovoitov List of files: /linux/tools/testing/selftests/bpf/progs/rhash_timer.c