[PATCH bpf-next 0/2] bpf: Reject mixed arena and ordinary atomic paths

Atomic RMW instructions use a single aux pointer type to select their final
instruction encoding. The verifier currently records that type only for
PTR_TO_ARENA, allowing a second path with an ordinary pointer to reach the
same instruction before fixups rewrite it to BPF_PROBE_ATOMIC.

Patch 1 records the destination type for every atomic RMW path so the existing
pointer mismatch check rejects incompatible uses of one instruction.

Patch 2 adds a verifier regression test with PTR_TO_ARENA and
PTR_TO_MAP_VALUE paths converging on one atomic add.

Yiyang Chen (2):
  bpf: Check pointer type for all atomic RMW paths
  selftests/bpf: Cover mixed arena and map-value atomics

Signed-off-by: Yiyang Chen <[email protected]>
---
Yiyang Chen (2):
      bpf: Check pointer type for all atomic RMW paths
      selftests/bpf: Cover mixed arena and map-value atomics

 kernel/bpf/verifier.c                              |  8 ++--
 tools/testing/selftests/bpf/progs/verifier_arena.c | 44 ++++++++++++++++++++++
 2 files changed, 47 insertions(+), 5 deletions(-)
---
base-commit: 6f033615ef8fb2374daa7e50a8ff68616bc850d2
-- 
2.43.0