Atomic RMW instructions use a single aux pointer type to select their final instruction encoding. The verifier currently records that type only for PTR_TO_ARENA, allowing a second path with an ordinary pointer to reach the same instruction before fixups rewrite it to BPF_PROBE_ATOMIC.
Patch 1 records the destination type for every atomic RMW path so the existing pointer mismatch check rejects incompatible uses of one instruction. Patch 2 adds a verifier regression test with PTR_TO_ARENA and PTR_TO_MAP_VALUE paths converging on one atomic add. Yiyang Chen (2): bpf: Check pointer type for all atomic RMW paths selftests/bpf: Cover mixed arena and map-value atomics Signed-off-by: Yiyang Chen <[email protected]> --- Yiyang Chen (2): bpf: Check pointer type for all atomic RMW paths selftests/bpf: Cover mixed arena and map-value atomics kernel/bpf/verifier.c | 8 ++-- tools/testing/selftests/bpf/progs/verifier_arena.c | 44 ++++++++++++++++++++++ 2 files changed, 47 insertions(+), 5 deletions(-) --- base-commit: 6f033615ef8fb2374daa7e50a8ff68616bc850d2 -- 2.43.0
