BPF gets bulk memory-safety and lifetime fixes

Alexei Starovoitov has submitted a 38-patch series for bpf-next that closes a large set of memory-safety, object-lifetime, and locking bugs in the BPF core, the verifier, and BPF's networking path. All but one of the fixes are from Josef Bacik. Each bug was reproduced in a VM on the kernel immediately before and after the change that addresses it.

The failures fall into several patterns that let BPF programs touch freed or unbound kernel state. Sleepable programs could run hash-map and VMA iterator callbacks without the RCU protection those paths require, and workqueue and task-work callbacks could use maps that assume an RCU read-side critical section. Iterator and writable raw-tracepoint programs could pass oversized buffers through tail calls and extensions, or write over live map values that still held timers, spin locks, and kernel pointers. Link updates could also skip attach size checks.

The socket-local storage map iterator could hand out a socket still under construction by clone, drop the socket while a program ran, or NULL-dereference when the socket vanished. Related lifetime fixes stop map and program teardown from freeing elements and exception tables under sleepable readers, keep inner maps and workqueue-backed programs alive for their callbacks, and prevent owner reference counts from saturating on the last unpin.

On the data path, XDP devmap egress no longer frees page-pool fragments as plain pages, offload state is refreshed when a device-bound program is reallocated, and programs are not left bound to a netdev that is unregistering. Segment-routing End.BPF paths gain header validation and pull fixes after decap, and room-adjustment helpers can no longer drive TCP GSO size to zero or wrap it. Dynptr writes that reallocate an skb head no longer read the freed old head or copy overlapping slices with plain memcpy.

Taken together, the series hardens the contract between the verifier, maps, and helpers so sleepable and iterator programs cannot outlive the objects they walk, and packet writers cannot chase pointers into memory the stack has already released.