BPF verifier rewrite and kernel fixes

BPF development dominated the day with a large verifier overhaul aimed at complex programs, alongside security hardening in helpers, networking, and filesystems. Several series also addressed lock safety, device trust, and overflow bugs in core subsystems.

BPF verifier rewritten to join states

Alexei Starovoitov posted successive v3 and v4 patch series (45 then 46 patches) that rewrite the BPF verifier to join states at control-flow merges instead of enumerating paths. The change cuts path explosion and is intended to let hundreds of previously rejected complex programs, especially those written in Rust, load successfully. Discussion on bpf.vger.kernel.org focused on correctness of the new join logic and remaining edge cases.

BTF support for fmod_ret targets

A v1 18-patch series proposes BTF ID sets for fmod_ret targets, an LLVM plugin to auto-discover them, verifier restrictions, decl tags, and bpftool integration. The work aims to make fmod_ret attachments safer and more discoverable for tooling. Reviewers examined the discovery mechanism and the tightness of the new verifier checks.

Maple tree and rhashtable lock fixes

A four-patch series corrects an RCU NULL dereference in maple_tree and a deadlock in rhashtable when kvmalloc(GFP_ATOMIC) is called under lock. Linus Torvalds described the recent kvmalloc change as buggy, prompting the fixes ahead of the 7.3 cycle. The patches restore safe allocation behavior under the affected locking paths.

Frame-scoped lifetimes for BPF callbacks

A four-patch BPF series scopes callback argument lifetimes to their stack frame inside the verifier. The change closes kernel stack leaks and arbitrary read/write paths previously reachable through ringbuf_drain and arraymap helpers. The patches treat the issue as a security boundary problem rather than a mere convenience restriction.

Virtio UDP tunnel GSO validation

An eight-patch net series validates the outer protocol of UDP tunnel GSO packets in virtio_net and tun. Invalid outer headers previously triggered skb_under_panic crashes on the host. The fix adds the missing checks before GSO processing proceeds.

Device trust levels before driver binding

A 17-patch driver-core series generalizes the PCI untrusted flag into cross-bus trust levels (disabled, adversary, full) with userspace policy hooks. The goal is to support confidential-computing scenarios that must decide trust before a driver binds. Review covered the policy interface and how existing buses would adopt the new states.

Squashfs overflow and sanity fixes

The Squashfs maintainer submitted an 18-patch series addressing arithmetic and variable overflows plus missing sanity checks. Several of the bugs could produce out-of-bounds access or oversized kmalloc calls. The patches replace ad-hoc checks with consistent bounds handling throughout the filesystem code.