Commit 1abd3feb3663 for kernel

commit 1abd3feb36636b28d7722851fc0c8d392a87e12d
Merge: a1e5c46eaed3 4ac95c65efea
Author: Alexei Starovoitov <ast@kernel.org>
Date:   Sat Mar 21 13:12:17 2026 -0700

    Merge branch 'bpf-fix-abs-int_min-undefined-behavior-in-interpreter-sdiv-smod'

    Jenny Guanni Qu says:

    ====================
    bpf: Fix abs(INT_MIN) undefined behavior in interpreter sdiv/smod

    The BPF interpreter's signed 32-bit division and modulo handlers use
    abs() on s32 operands, which is undefined for S32_MIN. This causes
    the interpreter to compute wrong results, creating a mismatch with
    the verifier's range tracking.

    For example, INT_MIN / 2 returns 0x40000000 instead of the correct
    0xC0000000. The verifier tracks the correct range, so a crafted BPF
    program can exploit the mismatch for out-of-bounds map value access
    (confirmed by KASAN).

    Patch 1 introduces abs_s32() which handles S32_MIN correctly and
    replaces all 8 abs((s32)...) call sites. s32 is the only affected
    case -- the s64 handlers do not use abs().

    Patch 2 adds selftests covering sdiv32 and smod32 with INT_MIN
    dividend to prevent regression.

    Changes since v4:
      - Renamed __safe_abs32() to abs_s32() and dropped inline keyword
        per Alexei Starovoitov's feedback

    Changes since v3:
      - Fixed stray blank line deletion in the file header
      - Improved comment per Yonghong Song's suggestion
      - Added JIT vs interpreter context to selftest commit message

    Changes since v2:
      - Simplified to use -(u32)x per Mykyta Yatsenko's suggestion

    Changes since v1:
      - Moved helper above kerneldoc comment block to fix build warnings
    ====================

    Link: https://patch.msgid.link/20260311011116.2108005-1-qguanni@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>