Merge branch 'bpf-reject-mixed-arena-and-ordinary-atomic-paths'

Yiyang Chen says:

====================
bpf: Reject mixed arena and ordinary atomic paths

Atomic RMW instructions use a single aux pointer type to select their final
instruction encoding. The verifier currently records that type only for
PTR_TO_ARENA, allowing a second path with an ordinary pointer to reach the
same instruction before fixups rewrite it to BPF_PROBE_ATOMIC.

Patch 1 records the destination type for every atomic RMW path so the existing
pointer mismatch check rejects incompatible uses of one instruction.

Patch 2 adds a verifier regression test with PTR_TO_ARENA and
PTR_TO_STACK paths converging on one atomic add.
====================

Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-0-4644c1886dbc@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>

tools/testing/selftests/bpf/progs/verifier_arena.c

@@ -635,7 +635,37 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx)
 	return 0;
 }
 
-#endif
+SEC("socket")
+__description("arena and stack atomic at the same instruction")
+__failure __msg("same insn cannot be used with different pointers")
+__arch_x86_64
+__load_if_JITed()
+__naked void mixed_arena_stack_atomic(void)
+{
+	asm volatile ("					\
+	r1 = %[arena] ll;				\
+	r6 = r10;					\
+	r6 += -8;					\
+	r9 = 0;						\
+	*(u64 *)(r6 + 0) = r9;				\
+	r7 = 8192;					\
+	r7 = addr_space_cast(r7, 0, 1);			\
+	call %[bpf_get_prandom_u32];			\
+	if w0 != 0 goto 1f;				\
+	r8 = r6;					\
+	goto 2f;					\
+1:	r8 = r7;					\
+2:	r9 = 1;						\
+	lock *(u64 *)(r8 + 0) += r9;			\
+	r0 = 0;						\
+	exit;						\
+"	:
+	: __imm_addr(arena),
+	  __imm(bpf_get_prandom_u32)
+	: __clobber_all);
+}
+
+#endif /* defined(__BPF_FEATURE_ADDR_SPACE_CAST) */
 
 static __noinline
 u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg)