Re: [PATCH bpf-next 1/2] bpf, riscv: Add support for signed arena loads

[Chen Pei <cp0613@linux.alibaba.com>]

Hi Lehui,

Thanks a lot for testing and catching this!

On 2026/8/19 11:41, Pu Lehui wrote:
> oops
> 
> need to revert this reviewed-by
> 
> [...]
> 
> Hi Chen Pei,
> 
> It's happy for the verifier_ldsx, but it not happy for the other test,
> pls take a look.
> 
> [2026-08-19 11:33:21]  [   35.541573] WARNING:
> arch/riscv/net/bpf_jit_comp64.c:915 at add_exception_handler+0xce/0xf0,
> CPU#0: test_progs/122

I reproduced it locally with arena_atomics on riscv64 QEMU and found the
root cause. It is indeed a bug introduced by this patch.

BPF_PROBE_MEM32SX is defined as 0xc0, which collides with the mode bits
of BPF_ATOMIC (also 0xc0). The riscv add_exception_handler() gates only
on BPF_MODE(), so adding BPF_PROBE_MEM32SX to that gate lets every plain
STX atomic insn (including on-stack atomics, whose JIT emit path also
sets ex_insn_off) pass the gate and register an exception table entry.
That overflows aux->num_exentries, triggers the WARN you saw and fails
the JIT pass with -ENOTSUPP.

Since BPF_PROBE_MEM32SX only exists for loads, the fix is to restrict
the PROBE_MEM32SX check in the gate to the LDX class, so that plain
atomic insns are filtered out again.

I have fixed and verified it locally on riscv64 QEMU: arena_atomics now
loads all ten programs cleanly with no warnings, and all five
arena_ldsx tests still pass. The fix will be included in v2, which I
will send shortly. Thanks again for the review and the report!

Best regards,
Pei