Re: [PATCH bpf-next 1/2] bpf: Check pointer type for all atomic RMW paths
Eduard Zingerman <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.bpf,org.kernel.vger.linux-kselftest |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 2026-08-13 at 12:01 +0000, Yiyang Chen wrote:
> Atomic RMW verification records an instruction pointer type only when the
> current destination is PTR_TO_ARENA. A second path can therefore reach the
> same instruction with an ordinary pointer without comparing it against the
> saved arena type.
>
> The post-verification fixup uses the saved type to rewrite the instruction
> to BPF_PROBE_ATOMIC for every path. Record the actual destination type for
> all atomic RMW paths so the existing mismatch check rejects incompatible
> uses of one instruction.
>
> Fixes: d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
> Signed-off-by: Yiyang Chen <[email protected]>
> ---
Acked-by: Eduard Zingerman <[email protected]>
Looks like this was the only missing case for save_aux_ptr_type().
I wonder if we should pull the save_aux_ptr_type() call from
it's current positions to do_check_insn() itself.
...