[PATCH bpf-next v2 0/2] bpf: Reject mixed arena and ordinary atomic paths

[PATCH bpf-next v2 0/2] bpf: Reject mixed arena and ordinary atomic paths

[Yiyang Chen]

Atomic RMW instructions use a single aux pointer type to select their final
instruction encoding. The verifier currently records that type only for
PTR_TO_ARENA, allowing a second path with an ordinary pointer to reach the
same instruction before fixups rewrite it to BPF_PROBE_ATOMIC.

Patch 1 records the destination type for every atomic RMW path so the existing
pointer mismatch check rejects incompatible uses of one instruction.

Patch 2 adds a verifier regression test with PTR_TO_ARENA and
PTR_TO_STACK paths converging on one atomic add.

Yiyang Chen (2):
  bpf: Check pointer type for all atomic RMW paths
  selftests/bpf: Cover mixed arena and stack atomics

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
---
Changes in v2:
- Remove the arena global and extra map from the selftest; reuse the existing
  arena map and a stack destination.
- Construct the arena pointer from a scalar and encode the cast with
  __imm_insn.
- Rebase onto bpf-next commit c93cbdb13f99.
- Link to v1: https://lore.kernel.org/r/20260813-bpf-next-038-mixed-atomic-v1-v1-0-e79aadb46a8a@mails.tsinghua.edu.cn

---
Yiyang Chen (2):
      bpf: Check pointer type for all atomic RMW paths
      selftests/bpf: Cover mixed arena and stack atomics

 kernel/bpf/verifier.c                              |  8 ++---
 tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
 2 files changed, 42 insertions(+), 5 deletions(-)
---
base-commit: c93cbdb13f995f87b5356329b3fe551c80bb482d
-- 
2.43.0

[PATCH bpf-next v2 1/2] bpf: Check pointer type for all atomic RMW paths

[Yiyang Chen]

Atomic RMW verification records an instruction pointer type only when the
current destination is PTR_TO_ARENA. A second path can therefore reach the
same instruction with an ordinary pointer without comparing it against the
saved arena type.

The post-verification fixup uses the saved type to rewrite the instruction
to BPF_PROBE_ATOMIC for every path. Record the actual destination type for
all atomic RMW paths so the existing mismatch check rejects incompatible
uses of one instruction.

Fixes: d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
---
 kernel/bpf/verifier.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d17f14b35b79f..93463caf5c9ad 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6739,11 +6739,9 @@ static int check_atomic_rmw(struct bpf_verifier_env *env,
 	if (err)
 		return err;
 
-	if (is_arena_reg(env, insn->dst_reg)) {
-		err = save_aux_ptr_type(env, PTR_TO_ARENA, false);
-		if (err)
-			return err;
-	}
+	err = save_aux_ptr_type(env, dst_reg->type, false);
+	if (err)
+		return err;
 	/* Check whether we can write into the same memory. */
 	err = check_mem_access(env, env->insn_idx, dst_reg, argno_from_reg(insn->dst_reg), insn->off,
 			       BPF_SIZE(insn->code), BPF_WRITE, -1, true, false);

-- 
2.43.0

[PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

[Yiyang Chen]

Add a verifier test with one atomic RMW instruction reached through
PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
shared instruction with the existing incompatible-pointer diagnostic.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
---
 tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
index b241bbcf54a8a..b22bab33301ab 100644
--- a/tools/testing/selftests/bpf/progs/verifier_arena.c
+++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
@@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
 
 #endif
 
+static const struct bpf_insn addr_space_cast_insn = {
+	.code = 0xbf,
+	.dst_reg = BPF_REG_7,
+	.src_reg = BPF_REG_7,
+	.off = 1,
+	.imm = 1,
+};
+
+SEC("socket")
+__description("arena and stack atomic at the same instruction")
+__failure __msg("same insn cannot be used with different pointers")
+__arch_x86_64
+__load_if_JITed()
+__naked void mixed_arena_stack_atomic(void)
+{
+	asm volatile ("					\
+	r1 = %[arena] ll;				\
+	r6 = r10;					\
+	r6 += -8;					\
+	r9 = 0;					\
+	*(u64 *)(r6 + 0) = r9;			\
+	r7 = 8192;					\
+	.8byte %[addr_space_cast];			\
+	call %[bpf_get_prandom_u32];			\
+	if w0 != 0 goto 1f;				\
+	r8 = r6;					\
+	goto 2f;					\
+1:	r8 = r7;					\
+2:	r9 = 1;					\
+	lock *(u64 *)(r8 + 0) += r9;			\
+	r0 = 0;					\
+	exit;						\
+"	:
+	: __imm_addr(arena),
+	  __imm_insn(addr_space_cast, addr_space_cast_insn),
+	  __imm(bpf_get_prandom_u32)
+	: __clobber_all);
+}
+
 static __noinline
 u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
 {

-- 
2.43.0

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2615 bytes --]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
> index b241bbcf54a8..b22bab33301a 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
>
>  #endif
>
> +static const struct bpf_insn addr_space_cast_insn = {
> +	.code = 0xbf,
> +	.dst_reg = BPF_REG_7,
> +	.src_reg = BPF_REG_7,
> +	.off = 1,
> +	.imm = 1,
> +};

This isn't a bug, but could the struct carry the same kind of decoding
comments as the raw insns in stream.c?  The register fields are written
symbolically (BPF_REG_7) while the three fields that actually need decoding
are bare numbers: .code = 0xbf is BPF_ALU64 | BPF_MOV | BPF_X, .off = 1 is
BPF_ADDR_SPACE_CAST, and .imm = 1 is the (dst_as << 16) | src_as encoding
for as(1) -> as(0).

Could it be annotated like stream.c does (e.g. /* BPF_ALU64 | BPF_MOV |
BPF_X */, /* BPF_ADDR_SPACE_CAST */, /* (dst_as << 16) | src_as */)?  And
could the .8byte line below note that it is r7 = addr_space_cast(r7, 0, 1)?

> +
> +SEC("socket")
> +__description("arena and stack atomic at the same instruction")
> +__failure __msg("same insn cannot be used with different pointers")
> +__arch_x86_64
> +__load_if_JITed()
> +__naked void mixed_arena_stack_atomic(void)
> +{
> +	asm volatile ("					\
> +	r1 = %[arena] ll;				\
> +	r6 = r10;					\
> +	r6 += -8;					\
> +	r9 = 0;					\
> +	*(u64 *)(r6 + 0) = r9;			\
> +	r7 = 8192;					\
> +	.8byte %[addr_space_cast];			\
> +	call %[bpf_get_prandom_u32];			\
> +	if w0 != 0 goto 1f;				\
> +	r8 = r6;					\
> +	goto 2f;					\
> +1:	r8 = r7;					\
> +2:	r9 = 1;					\
> +	lock *(u64 *)(r8 + 0) += r9;			\
> +	r0 = 0;					\
> +	exit;						\

This isn't a bug, but would it be worth adding one more tab on the r9 = 0;,
*(u64 *)(r6 + 0) = r9;, 2:\tr9 = 1; and r0 = 0; lines so the line
continuations line up like the rest of the block?  Four of the seventeen
continuation lines put the trailing backslash at column 48 instead of the
column 56 used by the other thirteen lines.

> +"	:
> +	: __imm_addr(arena),
> +	  __imm_insn(addr_space_cast, addr_space_cast_insn),
> +	  __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
>  static __noinline
>  u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
>  {


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31943300584

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

[Eduard Zingerman]

On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote:
> Add a verifier test with one atomic RMW instruction reached through
> PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
> shared instruction with the existing incompatible-pointer diagnostic.
> 
> Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> ---
>  tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
>  1 file changed, 39 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
> index b241bbcf54a8a..b22bab33301ab 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
>  
>  #endif
>  
> +static const struct bpf_insn addr_space_cast_insn = {
> +	.code = 0xbf,
> +	.dst_reg = BPF_REG_7,
> +	.src_reg = BPF_REG_7,
> +	.off = 1,
> +	.imm = 1,
> +};
> +
> +SEC("socket")
> +__description("arena and stack atomic at the same instruction")
> +__failure __msg("same insn cannot be used with different pointers")
> +__arch_x86_64
> +__load_if_JITed()
> +__naked void mixed_arena_stack_atomic(void)
> +{
> +	asm volatile ("					\
> +	r1 = %[arena] ll;				\
> +	r6 = r10;					\
> +	r6 += -8;					\
> +	r9 = 0;					\
> +	*(u64 *)(r6 + 0) = r9;			\
> +	r7 = 8192;					\
> +	.8byte %[addr_space_cast];			\

I'm going to fix this to:

	r7 = addr_space_cast(r7, 0, 1);			\

as in the test case above.
Waiting for CI [1].

[1] https://github.com/kernel-patches/bpf/pull/13325

> +	call %[bpf_get_prandom_u32];			\
> +	if w0 != 0 goto 1f;				\
> +	r8 = r6;					\
> +	goto 2f;					\
> +1:	r8 = r7;					\
> +2:	r9 = 1;					\
> +	lock *(u64 *)(r8 + 0) += r9;			\
> +	r0 = 0;					\
> +	exit;						\
> +"	:
> +	: __imm_addr(arena),
> +	  __imm_insn(addr_space_cast, addr_space_cast_insn),
> +	  __imm(bpf_get_prandom_u32)
> +	: __clobber_all);
> +}
> +
>  static __noinline
>  u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
>  {

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

[Eduard Zingerman]

On Sun, 2026-08-16 at 16:17 -0700, Eduard Zingerman wrote:
> On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote:
> > Add a verifier test with one atomic RMW instruction reached through
> > PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
> > shared instruction with the existing incompatible-pointer diagnostic.
> > 
> > Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> > ---
> >  tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
> >  1 file changed, 39 insertions(+)
> > 
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > index b241bbcf54a8a..b22bab33301ab 100644
> > --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> > +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
> >  
> >  #endif
> >  
> > +static const struct bpf_insn addr_space_cast_insn = {
> > +	.code = 0xbf,
> > +	.dst_reg = BPF_REG_7,
> > +	.src_reg = BPF_REG_7,
> > +	.off = 1,
> > +	.imm = 1,
> > +};
> > +
> > +SEC("socket")
> > +__description("arena and stack atomic at the same instruction")
> > +__failure __msg("same insn cannot be used with different pointers")
> > +__arch_x86_64
> > +__load_if_JITed()
> > +__naked void mixed_arena_stack_atomic(void)
> > +{
> > +	asm volatile ("					\
> > +	r1 = %[arena] ll;				\
> > +	r6 = r10;					\
> > +	r6 += -8;					\
> > +	r9 = 0;					\
> > +	*(u64 *)(r6 + 0) = r9;			\
> > +	r7 = 8192;					\
> > +	.8byte %[addr_space_cast];			\
> 
> I'm going to fix this to:
> 
> 	r7 = addr_space_cast(r7, 0, 1);			\
> 
> as in the test case above.
> Waiting for CI [1].
> 
> [1] https://github.com/kernel-patches/bpf/pull/13325


A...and it requires another exception for GCC-BPF:
https://github.com/kernel-patches/bpf/blob/bpf-next_base/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc

Ihor, it's a third time GCC-BPF strikes this weekend.
What do people think about downgrading it to may-fail until the
DENYLIST decreases to something reasonable?

Anyway, I'll wrap-up with this patch-set in the evening.

> > +	call %[bpf_get_prandom_u32];			\
> > +	if w0 != 0 goto 1f;				\
> > +	r8 = r6;					\
> > +	goto 2f;					\
> > +1:	r8 = r7;					\
> > +2:	r9 = 1;					\
> > +	lock *(u64 *)(r8 + 0) += r9;			\
> > +	r0 = 0;					\
> > +	exit;						\
> > +"	:
> > +	: __imm_addr(arena),
> > +	  __imm_insn(addr_space_cast, addr_space_cast_insn),
> > +	  __imm(bpf_get_prandom_u32)
> > +	: __clobber_all);
> > +}
> > +
> >  static __noinline
> >  u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)
> >  {

Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover mixed arena and stack atomics

[Eduard Zingerman]

On Sun, 2026-08-16 at 16:36 -0700, Eduard Zingerman wrote:
> On Sun, 2026-08-16 at 16:17 -0700, Eduard Zingerman wrote:
> > On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote:
> > > Add a verifier test with one atomic RMW instruction reached through
> > > PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the
> > > shared instruction with the existing incompatible-pointer diagnostic.
> > > 
> > > Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
> > > ---
> > >  tools/testing/selftests/bpf/progs/verifier_arena.c | 39 ++++++++++++++++++++++
> > >  1 file changed, 39 insertions(+)
> > > 
> > > diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > index b241bbcf54a8a..b22bab33301ab 100644
> > > --- a/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c
> > > @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
> > >  
> > >  #endif
> > >  
> > > +static const struct bpf_insn addr_space_cast_insn = {
> > > +	.code = 0xbf,
> > > +	.dst_reg = BPF_REG_7,
> > > +	.src_reg = BPF_REG_7,
> > > +	.off = 1,
> > > +	.imm = 1,
> > > +};
> > > +
> > > +SEC("socket")
> > > +__description("arena and stack atomic at the same instruction")
> > > +__failure __msg("same insn cannot be used with different pointers")
> > > +__arch_x86_64
> > > +__load_if_JITed()
> > > +__naked void mixed_arena_stack_atomic(void)
> > > +{
> > > +	asm volatile ("					\
> > > +	r1 = %[arena] ll;				\
> > > +	r6 = r10;					\
> > > +	r6 += -8;					\
> > > +	r9 = 0;					\
> > > +	*(u64 *)(r6 + 0) = r9;			\
> > > +	r7 = 8192;					\
> > > +	.8byte %[addr_space_cast];			\
> > 
> > I'm going to fix this to:
> > 
> > 	r7 = addr_space_cast(r7, 0, 1);			\
> > 
> > as in the test case above.
> > Waiting for CI [1].
> > 
> > [1] https://github.com/kernel-patches/bpf/pull/13325
> 
> 
> A...and it requires another exception for GCC-BPF:
> https://github.com/kernel-patches/bpf/blob/bpf-next_base/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc
> 
> Ihor, it's a third time GCC-BPF strikes this weekend.
> What do people think about downgrading it to may-fail until the
> DENYLIST decreases to something reasonable?

I'm not being fair here. ksock series shown a real deficiency in
verier logic, matchers in Daniel's series were unstable.
Please disregard the above suggestion.

Re: [PATCH bpf-next v2 0/2] bpf: Reject mixed arena and ordinary atomic paths

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Eduard Zingerman <eddyz87@gmail.com>:

On Sun, 16 Aug 2026 10:56:32 +0000 you wrote:
> Atomic RMW instructions use a single aux pointer type to select their final
> instruction encoding. The verifier currently records that type only for
> PTR_TO_ARENA, allowing a second path with an ordinary pointer to reach the
> same instruction before fixups rewrite it to BPF_PROBE_ATOMIC.
> 
> Patch 1 records the destination type for every atomic RMW path so the existing
> pointer mismatch check rejects incompatible uses of one instruction.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/2] bpf: Check pointer type for all atomic RMW paths
    https://git.kernel.org/bpf/bpf-next/c/4bc49ae344d6
  - [bpf-next,v2,2/2] selftests/bpf: Cover mixed arena and stack atomics
    https://git.kernel.org/bpf/bpf-next/c/5ab9fbeca8f7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html