Syzbot CI

Subject	bpf: Fixes for the verifier, arena, skb and lwt helpers
Author	alexei.starovoitov@gmail.com
Date	2026-11-01 19:05:09 +0000 UTC
Version
Cc	alexei.starovoitov@gmail.com andrii@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com josef@toxicpanda.com mason@kernel.org memxor@gmail.com

Subject

bpf: Fixes for the verifier, arena, skb and lwt helpers

Author

alexei.starovoitov@gmail.com

Date

2026-11-01 19:05:09 +0000 UTC

Version

alexei.starovoitov@gmail.com andrii@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com josef@toxicpanda.com mason@kernel.org memxor@gmail.com

Name	Content [All]
[PATCH bpf 01/27] bpf: Clamp the trace length in __bpf_get_stack() again	[Body]
[PATCH bpf 02/27] bpf: Clamp the trace length before the skip test in stackid_init()	[Body]
[PATCH bpf 03/27] bpf: Refuse to map an arena at address 0	[Body]
[PATCH bpf 04/27] bpf: Don't let bpf_arena_free_pages() see a half-set user range	[Body]
[PATCH bpf 05/27] bpf: Refuse an arena mmap() longer than max_entries pages	[Body]
[PATCH bpf 06/27] bpf: Remove the WARN from arena_get_unmapped_area()	[Body]
[PATCH bpf 07/27] selftests/bpf: Test the length and the address of an arena mmap()	[Body]
[PATCH bpf 08/27] bpf: Reject memory for kfunc projection type args	[Body]
[PATCH bpf 09/27] bpf: Don't turn struct arguments of KF_ACQUIRE kfuncs into memory	[Body]
[PATCH bpf 10/27] bpf: Don't turn kfunc arguments of an empty struct type into memory	[Body]
[PATCH bpf 11/27] bpf: Compare the arguments of an extension with those of its target	[Body]
[PATCH bpf 12/27] selftests/bpf: Test the arguments of an extension prog	[Body]
[PATCH bpf 13/27] bpf: Require prog fd or capability for cgroup detach	[Body]
[PATCH bpf 14/27] bpf, cgroup: Keep the skb network offset signed	[Body]
[PATCH bpf 15/27] bpf: Don't let bpf_skb_adjust_room() raise gso_size to GSO_BY_FRAGS	[Body]
[PATCH bpf 16/27] bpf: Reject non-IPv6 packets in BPF_LWT_ENCAP_SEG6	[Body]
[PATCH bpf 17/27] bpf: Set a dst for test runs of lwt_in progs	[Body]
[PATCH bpf 18/27] bpf: Limit the SRH length in bpf_lwt_seg6_adjust_srh()	[Body]
[PATCH bpf 19/27] bpf: Don't look for the SRH again in the End.BPF helpers	[Body]
[PATCH bpf 20/27] bpf: Move the MAC header in bpf_lwt_seg6_adjust_srh()	[Body]
[PATCH bpf 21/27] bpf: Don't leave a stale MAC header in bpf_lwt_push_ip_encap()	[Body]
[PATCH bpf 22/27] bpf: Reset skb->cb after an lwt prog pushes an IP header	[Body]
[PATCH bpf 23/27] bpf: Require BPF_LWT_REROUTE when an lwt_in prog changes the protocol	[Body]
[PATCH bpf 24/27] bpf: Don't let lwt_in progs call into IPv6 when it is disabled	[Body]
[PATCH bpf 25/27] bpf: Move the transport header with the moved headers	[Body]
[PATCH bpf 26/27] bpf: Use the inner transport header after a decap	[Body]
[PATCH bpf 27/27] bpf: Check the offset in bpf_skb_generic_{push,pop}()	[Body]

Name

Content [All]

[PATCH bpf 01/27] bpf: Clamp the trace length in __bpf_get_stack() again

[PATCH bpf 02/27] bpf: Clamp the trace length before the skip test in stackid_init()

[PATCH bpf 03/27] bpf: Refuse to map an arena at address 0

[PATCH bpf 04/27] bpf: Don't let bpf_arena_free_pages() see a half-set user range

[PATCH bpf 05/27] bpf: Refuse an arena mmap() longer than max_entries pages

[PATCH bpf 06/27] bpf: Remove the WARN from arena_get_unmapped_area()

[PATCH bpf 07/27] selftests/bpf: Test the length and the address of an arena mmap()

[PATCH bpf 08/27] bpf: Reject memory for kfunc projection type args

[PATCH bpf 09/27] bpf: Don't turn struct arguments of KF_ACQUIRE kfuncs into memory

[PATCH bpf 10/27] bpf: Don't turn kfunc arguments of an empty struct type into memory

[PATCH bpf 11/27] bpf: Compare the arguments of an extension with those of its target

[PATCH bpf 12/27] selftests/bpf: Test the arguments of an extension prog

[PATCH bpf 13/27] bpf: Require prog fd or capability for cgroup detach

[PATCH bpf 14/27] bpf, cgroup: Keep the skb network offset signed

[PATCH bpf 15/27] bpf: Don't let bpf_skb_adjust_room() raise gso_size to GSO_BY_FRAGS

[PATCH bpf 16/27] bpf: Reject non-IPv6 packets in BPF_LWT_ENCAP_SEG6

[PATCH bpf 17/27] bpf: Set a dst for test runs of lwt_in progs

[PATCH bpf 18/27] bpf: Limit the SRH length in bpf_lwt_seg6_adjust_srh()

[PATCH bpf 19/27] bpf: Don't look for the SRH again in the End.BPF helpers

[PATCH bpf 20/27] bpf: Move the MAC header in bpf_lwt_seg6_adjust_srh()

[PATCH bpf 21/27] bpf: Don't leave a stale MAC header in bpf_lwt_push_ip_encap()

[PATCH bpf 22/27] bpf: Reset skb->cb after an lwt prog pushes an IP header

[PATCH bpf 23/27] bpf: Require BPF_LWT_REROUTE when an lwt_in prog changes the protocol

[PATCH bpf 24/27] bpf: Don't let lwt_in progs call into IPv6 when it is disabled

[PATCH bpf 25/27] bpf: Move the transport header with the moved headers

[PATCH bpf 26/27] bpf: Use the inner transport header after a decap

[PATCH bpf 27/27] bpf: Check the offset in bpf_skb_generic_{push,pop}()

Session 2026-11-01

Passed

ID (for dev)	6f2402a3-4794-46f3-8156-6a08a487e9fa
Status	finished
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config]		passed [Log]
[KASAN] Boot test: Base	5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config]		passed [Log]
[KASAN] Build Patched		5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config] [patched]	passed [Log]
[KASAN] Fuzz	5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config]	5b96632457e4ccae88ecb751cf48176b2e3629a7 [Config] [patched]	passed [Log] [Artifacts]

Patches (27)

Series Summary

Sessions

Session 2026-11-01