Re: [PATCH bpf-next 1/2] bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu,  9 Apr 2026 17:50:15 +0200 you wrote:
> When a pkt pointer acquires AT_PKT_END or BEYOND_PKT_END range from
> a comparison, and then, known-constant arithmetic is performed,
> adjust_ptr_min_max_vals() copies the stale range via dst_reg->raw =
> ptr_reg->raw without clearing the negative reg->range sentinel values.
> 
> This lets is_pkt_ptr_branch_taken() choose one branch direction and
> skip going through the other. Fix this by clearing negative pkt range
> values (that is, AT_PKT_END and BEYOND_PKT_END) after arithmetic on
> pkt pointers. This ensures is_pkt_ptr_branch_taken() returns unknown
> and both branches are properly verified.
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken
    https://git.kernel.org/bpf/bpf-next/c/9f118095dd34
  - [bpf-next,2/2] selftests/bpf: Add test for stale pkt range after scalar arithmetic
    https://git.kernel.org/bpf/bpf-next/c/8697bdd67be8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html