From: Alexei Starovoitov Date: Sat, 21 Mar 2026 20:14:28 +0000 (-0700) Subject: Merge branch 'bpf-fix-unsound-scalar-forking-for-bpf_or' X-Git-Tag: v7.0-rc5~2^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06880982c63012eb392df64c1ca587c294a72226;p=thirdparty%2Flinux.git Merge branch 'bpf-fix-unsound-scalar-forking-for-bpf_or' Daniel Wade says: ==================== bpf: Fix unsound scalar forking for BPF_OR maybe_fork_scalars() unconditionally sets the pushed path dst register to 0 for both BPF_AND and BPF_OR. For AND this is correct (0 & K == 0), but for OR it is wrong (0 | K == K, not 0). This causes the verifier to track an incorrect value on the pushed path, leading to a verifier/runtime divergence that allows out-of-bounds map value access. v4: Use block comment style for multi-line comments in selftests (Amery Hung) Add Reviewed-by/Acked-by tags v3: Use single-line comment style in selftests (Alexei Starovoitov) v2: Use push_stack(env, env->insn_idx, ...) to re-execute the insn on the pushed path (Eduard Zingerman) ==================== Link: https://patch.msgid.link/20260314021521.128361-1-danjwade95@gmail.com Signed-off-by: Alexei Starovoitov --- 06880982c63012eb392df64c1ca587c294a72226