Commit 06880982c630 for kernel

commit 06880982c63012eb392df64c1ca587c294a72226
Merge: 1abd3feb3663 0ad1734cc559
Author: Alexei Starovoitov <ast@kernel.org>
Date:   Sat Mar 21 13:14:28 2026 -0700

    Merge branch 'bpf-fix-unsound-scalar-forking-for-bpf_or'

    Daniel Wade says:

    ====================
    bpf: Fix unsound scalar forking for BPF_OR

    maybe_fork_scalars() unconditionally sets the pushed path dst register
    to 0 for both BPF_AND and BPF_OR.  For AND this is correct (0 & K == 0),
    but for OR it is wrong (0 | K == K, not 0).  This causes the verifier to
    track an incorrect value on the pushed path, leading to a verifier/runtime
    divergence that allows out-of-bounds map value access.

    v4: Use block comment style for multi-line comments in selftests (Amery Hung)
        Add Reviewed-by/Acked-by tags
    v3: Use single-line comment style in selftests (Alexei Starovoitov)
    v2: Use push_stack(env, env->insn_idx, ...) to re-execute the insn
        on the pushed path (Eduard Zingerman)
    ====================

    Link: https://patch.msgid.link/20260314021521.128361-1-danjwade95@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>