Re: [PATCH bpf v4 0/2] bpf: Fix unsound scalar forking for BPF_OR

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Sat, 14 Mar 2026 13:15:19 +1100 you wrote:
> maybe_fork_scalars() unconditionally sets the pushed path dst register
> to 0 for both BPF_AND and BPF_OR.  For AND this is correct (0 & K == 0),
> but for OR it is wrong (0 | K == K, not 0).  This causes the verifier to
> track an incorrect value on the pushed path, leading to a verifier/runtime
> divergence that allows out-of-bounds map value access.
> 
> v4: Use block comment style for multi-line comments in selftests (Amery Hung)
>     Add Reviewed-by/Acked-by tags
> v3: Use single-line comment style in selftests (Alexei Starovoitov)
> v2: Use push_stack(env, env->insn_idx, ...) to re-execute the insn
>     on the pushed path (Eduard Zingerman)
> 
> [...]

Here is the summary with links:
  - [bpf,v4,1/2] bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
    https://git.kernel.org/bpf/bpf/c/c845894ebd6f
  - [bpf,v4,2/2] selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling
    https://git.kernel.org/bpf/bpf/c/0ad1734cc559

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html