Syzbot CI

Subject	bpf: Memory safety, lifetime and locking fixes
Author	alexei.starovoitov@gmail.com
Date	2026-10-17 01:20:21 +0000 UTC
Version
Cc	alexei.starovoitov@gmail.com andrii@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com josef@toxicpanda.com mason@kernel.org memxor@gmail.com netdev@vger.kernel.org

Subject

bpf: Memory safety, lifetime and locking fixes

Author

alexei.starovoitov@gmail.com

Date

2026-10-17 01:20:21 +0000 UTC

Version

alexei.starovoitov@gmail.com andrii@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com josef@toxicpanda.com mason@kernel.org memxor@gmail.com netdev@vger.kernel.org

Name	Content [All]
[PATCH bpf-next 01/38] bpf: use the frame mem type in devmap egress XDP	[Body]
[PATCH bpf-next 02/38] bpf: forbid sleeping in hash map for_each callbacks	[Body]
[PATCH bpf-next 03/38] bpf: don't leak the inode when token creation fails	[Body]
[PATCH bpf-next 04/38] bpf: don't hand out a linked element as extra element	[Body]
[PATCH bpf-next 05/38] bpf: reject sleepable programs for task_vma iterator	[Body]
[PATCH bpf-next 06/38] bpf: forbid sleeping in bpf_find_vma() callbacks	[Body]
[PATCH bpf-next 07/38] bpf: look at all 64 bits of a BPF_JSET mask on 32-bit	[Body]
[PATCH bpf-next 08/38] bpf: don't let bpf_skb_adjust_room() use up the MSS	[Body]
[PATCH bpf-next 09/38] bpf: Read the probe of a perf event under event_mutex	[Body]
[PATCH bpf-next 10/38] bpf: Don't saturate owner_refcnt on the last unpin	[Body]
[PATCH bpf-next 11/38] bpf: Validate the SRH which End.DT6 uncovers in End.BPF	[Body]
[PATCH bpf-next 12/38] bpf: Pull the inner header for End.DT6 in End.BPF	[Body]
[PATCH bpf-next 13/38] bpf: Update the SRH state if End.B6 fails late	[Body]
[PATCH bpf-next 14/38] bpf: Clear sk_refcnt of a clone before its storage is linked	[Body]
[PATCH bpf-next 15/38] bpf: Fix NULL deref in the sk_storage map iterator	[Body]
[PATCH bpf-next 16/38] bpf: Hold the socket in the sk_storage map iterator	[Body]
[PATCH bpf-next 17/38] bpf: Bound the nesting that the BTF show code follows	[Body]
[PATCH bpf-next 18/38] bpf: Check the new program of an iterator link update	[Body]
[PATCH bpf-next 19/38] bpf: Fix stale offload->prog pointer after realloc	[Body]
[PATCH bpf-next 20/38] bpf: Don't bind a program to a netdev that goes away	[Body]
[PATCH bpf-next 21/38] bpf: Keep a program until its bpf_wq callback has ended	[Body]
[PATCH bpf-next 22/38] bpf: Count sleepable callbacks as sleepable map users	[Body]
[PATCH bpf-next 23/38] bpf: Check the maps that sleepable callbacks use	[Body]
[PATCH bpf-next 24/38] bpf: Assume no bounds for buffers behind a tail call	[Body]
[PATCH bpf-next 25/38] bpf: Don't take an extension for an iterator program	[Body]
[PATCH bpf-next 26/38] bpf: Assume no bounds for a writable tp with tail calls	[Body]
[PATCH bpf-next 27/38] bpf: Keep iterator programs off special map fields	[Body]
[PATCH bpf-next 28/38] bpf: Free what map_free() unlinks for sleepable readers	[Body]
[PATCH bpf-next 29/38] bpf: Keep values of a dead owner for sleepable programs	[Body]
[PATCH bpf-next 30/38] bpf: Keep the symbols of a program until it has ended	[Body]
[PATCH bpf-next 31/38] bpf: Use the socket of a sk_lookup test run under RCU	[Body]
[PATCH bpf-next 32/38] bpf, cpumap: Hold the device of frames in the queue	[Body]
[PATCH bpf-next 33/38] bpf: Drop packet pointers behind kfuncs writing an skb	[Body]
[PATCH bpf-next 34/38] bpf: Let bpf_dynptr_write() mark a global function	[Body]
[PATCH bpf-next 35/38] bpf: Don't take a dynptr argument for a local dynptr	[Body]
[PATCH bpf-next 36/38] bpf: Follow the head if an skb is written from a slice	[Body]
[PATCH bpf-next 37/38] bpf: Use memmove() to store bytes in an skb	[Body]
[PATCH bpf-next 38/38] bpf: Refuse packet slices for packet-changing helpers	[Body]

Name

Content [All]

[PATCH bpf-next 01/38] bpf: use the frame mem type in devmap egress XDP

[PATCH bpf-next 02/38] bpf: forbid sleeping in hash map for_each callbacks

[PATCH bpf-next 03/38] bpf: don't leak the inode when token creation fails

[PATCH bpf-next 04/38] bpf: don't hand out a linked element as extra element

[PATCH bpf-next 05/38] bpf: reject sleepable programs for task_vma iterator

[PATCH bpf-next 06/38] bpf: forbid sleeping in bpf_find_vma() callbacks

[PATCH bpf-next 07/38] bpf: look at all 64 bits of a BPF_JSET mask on 32-bit

[PATCH bpf-next 08/38] bpf: don't let bpf_skb_adjust_room() use up the MSS

[PATCH bpf-next 09/38] bpf: Read the probe of a perf event under event_mutex

[PATCH bpf-next 10/38] bpf: Don't saturate owner_refcnt on the last unpin

[PATCH bpf-next 11/38] bpf: Validate the SRH which End.DT6 uncovers in End.BPF

[PATCH bpf-next 12/38] bpf: Pull the inner header for End.DT6 in End.BPF

[PATCH bpf-next 13/38] bpf: Update the SRH state if End.B6 fails late

[PATCH bpf-next 14/38] bpf: Clear sk_refcnt of a clone before its storage is linked

[PATCH bpf-next 15/38] bpf: Fix NULL deref in the sk_storage map iterator

[PATCH bpf-next 16/38] bpf: Hold the socket in the sk_storage map iterator

[PATCH bpf-next 17/38] bpf: Bound the nesting that the BTF show code follows

[PATCH bpf-next 18/38] bpf: Check the new program of an iterator link update

[PATCH bpf-next 19/38] bpf: Fix stale offload->prog pointer after realloc

[PATCH bpf-next 20/38] bpf: Don't bind a program to a netdev that goes away

[PATCH bpf-next 21/38] bpf: Keep a program until its bpf_wq callback has ended

[PATCH bpf-next 22/38] bpf: Count sleepable callbacks as sleepable map users

[PATCH bpf-next 23/38] bpf: Check the maps that sleepable callbacks use

[PATCH bpf-next 24/38] bpf: Assume no bounds for buffers behind a tail call

[PATCH bpf-next 25/38] bpf: Don't take an extension for an iterator program

[PATCH bpf-next 26/38] bpf: Assume no bounds for a writable tp with tail calls

[PATCH bpf-next 27/38] bpf: Keep iterator programs off special map fields

[PATCH bpf-next 28/38] bpf: Free what map_free() unlinks for sleepable readers

[PATCH bpf-next 29/38] bpf: Keep values of a dead owner for sleepable programs

[PATCH bpf-next 30/38] bpf: Keep the symbols of a program until it has ended

[PATCH bpf-next 31/38] bpf: Use the socket of a sk_lookup test run under RCU

[PATCH bpf-next 32/38] bpf, cpumap: Hold the device of frames in the queue

[PATCH bpf-next 33/38] bpf: Drop packet pointers behind kfuncs writing an skb

[PATCH bpf-next 34/38] bpf: Let bpf_dynptr_write() mark a global function

[PATCH bpf-next 35/38] bpf: Don't take a dynptr argument for a local dynptr

[PATCH bpf-next 36/38] bpf: Follow the head if an skb is written from a slice

[PATCH bpf-next 37/38] bpf: Use memmove() to store bytes in an skb

[PATCH bpf-next 38/38] bpf: Refuse packet slices for packet-changing helpers

Session 2026-10-17

in progress

ID (for dev)	12ee2b38-bbdd-4a10-b6d9-a56aa1edc0b2
Status	in progress
Triaged	OK [Log] [Trajectory]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config]		passed [Log]
[KASAN] Boot test: Base	645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config]		passed [Log]
[KASAN] Build Patched		645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config] [patched]	passed [Log]
[KASAN] Fuzz	645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config]	645f5fcf7a5582f5d6ed2322f41cb34076c63b2c [Config] [patched]	running [Log]

Patches (38)

Series Summary

Sessions

Session 2026-10-17