From 5ab9fbeca8f7da1b40697cf4e75257b9447f03f2 Mon Sep 17 00:00:00 2001 From: Yiyang Chen Date: Sun, 16 Aug 2026 10:56:34 +0000 Subject: [PATCH] selftests/bpf: Cover mixed arena and stack atomics Add a verifier test with one atomic RMW instruction reached through PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the shared instruction with the existing incompatible-pointer diagnostic. Signed-off-by: Yiyang Chen Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-2-4644c1886dbc@mails.tsinghua.edu.cn Signed-off-by: Eduard Zingerman --- .../selftests/bpf/progs/verifier_arena.c | 32 ++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c b/tools/testing/selftests/bpf/progs/verifier_arena.c index b241bbcf54a8..815f342eb4b0 100644 --- a/tools/testing/selftests/bpf/progs/verifier_arena.c +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c @@ -635,7 +635,37 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx) return 0; } -#endif +SEC("socket") +__description("arena and stack atomic at the same instruction") +__failure __msg("same insn cannot be used with different pointers") +__arch_x86_64 +__load_if_JITed() +__naked void mixed_arena_stack_atomic(void) +{ + asm volatile (" \ + r1 = %[arena] ll; \ + r6 = r10; \ + r6 += -8; \ + r9 = 0; \ + *(u64 *)(r6 + 0) = r9; \ + r7 = 8192; \ + r7 = addr_space_cast(r7, 0, 1); \ + call %[bpf_get_prandom_u32]; \ + if w0 != 0 goto 1f; \ + r8 = r6; \ + goto 2f; \ +1: r8 = r7; \ +2: r9 = 1; \ + lock *(u64 *)(r8 + 0) += r9; \ + r0 = 0; \ + exit; \ +" : + : __imm_addr(arena), + __imm(bpf_get_prandom_u32) + : __clobber_all); +} + +#endif /* defined(__BPF_FEATURE_ADDR_SPACE_CAST) */ static __noinline u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)