Commit c845894ebd6f for kernel

commit c845894ebd6fb43226b3118d6b017942550910c5
Author: Daniel Wade <danjwade95@gmail.com>
Date:   Sat Mar 14 13:15:20 2026 +1100

    bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR

    maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the
    source operand is a constant.  When dst has signed range [-1, 0], it
    forks the verifier state: the pushed path gets dst = 0, the current
    path gets dst = -1.

    For BPF_AND this is correct: 0 & K == 0.
    For BPF_OR this is wrong:    0 | K == K, not 0.

    The pushed path therefore tracks dst as 0 when the runtime value is K,
    producing an exploitable verifier/runtime divergence that allows
    out-of-bounds map access.

    Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to
    push_stack(), so the pushed path re-executes the ALU instruction with
    dst = 0 and naturally computes the correct result for any opcode.

    Fixes: bffacdb80b93 ("bpf: Recognize special arithmetic shift in the verifier")
    Signed-off-by: Daniel Wade <danjwade95@gmail.com>
    Reviewed-by: Amery Hung <ameryhung@gmail.com>
    Acked-by: Eduard Zingerman <eddyz87@gmail.com>
    Link: https://lore.kernel.org/r/20260314021521.128361-2-danjwade95@gmail.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5c0e6809024f..62377bcb66fd 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15999,7 +15999,7 @@ static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *ins
 	else
 		return 0;

-	branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+	branch = push_stack(env, env->insn_idx, env->insn_idx, false);
 	if (IS_ERR(branch))
 		return PTR_ERR(branch);