Eduard Zingerman 4814ed6406 bpf: zero extend the result of an arena 32-bit cmpxchg ...

bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from
BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before
bpf_opt_subreg_zext_lo32_rnd_hi32().

That pass emits an explicit zero extension for a 32-bit cmpxchg even
when bpf_jit_needs_zext() is false. This is done because on some
architectures 32-bit cmpxchg requires explicit zero extension for the
dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax
if comparison is successful, while BPF semantics declare that each
operation on a 32-bit register zero extends it's upper half.

is_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena
cmpxchg misses said zero extension adjustment. This patch adjusts
is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC.

Fixes: d503a04f8b ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260903171542.1438050-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

2026-09-03 18:54:45 -07:00

..

bpf

bpf: zero extend the result of an arena 32-bit cmpxchg

2026-09-03 18:54:45 -07:00

cgroup

Merge branch 'sched/urgent'

2026-08-14 16:12:58 +02:00

configs

slab: support for compiler-assisted type-based slab cache partitioning

2026-05-14 10:44:09 +02:00

debug

kgdb: update outdated references to kgdb_wait()

2026-04-21 16:41:54 +01:00

dma

Merge tag 'dma-mapping-7.2-2026-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

2026-06-17 12:20:21 -07:00

entry

entry: Rework trace_syscall_enter()

2026-07-20 20:38:40 +02:00

events

Merge tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 12:31:07 -07:00

futex

Merge tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 15:26:35 -07:00

gcov

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

irq

Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-08-20 08:16:04 -07:00

kcsan

kcsan: test: Adjust "expect" allocation type for kmalloc_obj

2026-02-26 09:54:08 -08:00

livepatch

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

liveupdate

Merge branch 'misc' into next

2026-08-04 10:51:49 +03:00

locking

irq,spin_lock: Add counted interrupt disabling/enabling

2026-08-10 10:50:18 +02:00

module

module: decompress: check return value of module_extend_max_pages()

2026-06-04 16:37:32 +00:00

power

PM: sleep: Allow disabling DPM watchdog by default

2026-07-23 15:46:34 +02:00

printk

printk: fix typos in comments

2026-06-02 15:36:06 +02:00

rcu

Merge tag 'timers-nohz-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

2026-06-15 13:48:52 +05:30

sched

Merge tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 16:23:56 -07:00

time

Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 16:56:25 -07:00

trace

Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2026-08-20 07:36:20 -07:00

unwind

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

.gitignore

kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute

2025-06-24 20:30:37 +09:00

acct.c

fs: move SB_I_USERNS_VISIBLE to FS_USERNS_MOUNT_RESTRICTED

2026-05-11 23:13:01 +02:00

async.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

audit_fsnotify.c

audit: fix recursive locking deadlock in audit_dupe_exe()

2026-05-27 19:15:34 -04:00

audit_tree.c

audit: use 'unsigned int' instead of 'unsigned'

2026-05-26 17:15:30 -04:00

audit_watch.c

audit: drop BUG_ON() from audit_add_to_parent()

2026-07-28 15:53:48 -04:00

audit.c

audit: fix potential integer overflow in audit_log_n_string()

2026-07-29 16:19:06 -04:00

audit.h

audit: fix recursive locking deadlock in audit_dupe_exe()

2026-05-27 19:15:34 -04:00

auditfilter.c

Merge tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

2026-08-19 16:21:32 -07:00

auditsc.c

audit: drop BUG_ON() from audit_signal_info_syscall()

2026-07-28 15:53:49 -04:00

backtracetest.c

…

bounds.c

x86/asm: Remove ANNOTATE_DATA_SPECIAL usage

2025-12-03 16:53:19 +01:00

capability.c

capability: Remove unused has_capability

2025-03-07 22:03:09 -06:00

cfi.c

cfi: Move BPF CFI types and helpers to generic code

2025-07-31 18:23:53 -07:00

compat.c

…

configs.c

…

context_tracking.c

context_tracking: Remove rcu_task_trace_heavyweight_{enter,exit}()

2026-01-01 16:39:46 +08:00

cpu_pm.c

syscore: Pass context data to callbacks

2025-11-14 10:01:52 +01:00

cpu.c

Merge tag 'smp-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-06-23 16:43:24 -07:00

crash_core_test.c

crash: add KUnit tests for crash_exclude_mem_range

2025-09-13 17:32:55 -07:00

crash_core.c

powerpc/kexec_file: Use crash_exclude_core_ranges() helper

2026-06-30 18:49:06 +03:00

crash_dump_dm_crypt.c

crash_dump: release keyring reference at the correct time

2026-07-13 10:04:47 +03:00

crash_reserve.c

kernel/crash: remove inclusion of crypto/sha1.h

2026-03-27 21:19:46 -07:00

cred.c

exec_state: relocate dumpable information

2026-05-26 11:02:01 +02:00

delayacct.c

delayacct: fix uapi timespec64 definition

2026-02-08 00:13:32 -08:00

dma.c

…

elfcorehdr.c

…

exec_domain.c

…

exec_state.c

exec_state: relocate dumpable information

2026-05-26 11:02:01 +02:00

exit.c

Merge tags 'ipc-7.3-rc1.misc' and 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-08-17 08:27:30 -07:00

exit.h

…

extable.c

…

fail_function.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

fork.c

Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 15:29:53 -07:00

freezer.c

freezer: Clarify that only cgroup1 freezer uses PM freezer

2025-10-30 20:10:27 +01:00

gen_kheaders.sh

kheaders: make it possible to override TAR

2025-08-06 10:23:36 +09:00

groups.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

hung_task.c

hung_task: explicitly report I/O wait state in log output

2026-03-27 21:19:40 -07:00

iomem.c

mm/memremap: Pass down MEMREMAP_* flags to arch_memremap_wb()

2025-02-21 15:05:38 +01:00

irq_work.c

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

2026-05-11 16:28:04 +02:00

jump_label.c

jump_label: use ATOMIC_INIT() for initialization of .enabled

2026-03-16 13:16:48 +01:00

kallsyms_internal.h

kallsyms: Get rid of kallsyms relative base

2026-01-22 15:58:22 -07:00

kallsyms_selftest.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

kallsyms_selftest.h

…

kallsyms.c

Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-02-12 12:13:01 -08:00

kcmp.c

fs: add real_fs to track task's actual fs_struct

2026-06-29 10:43:45 +02:00

Kconfig.freezer

…

Kconfig.hz

kernel: Fix "select" wording on HZ_250 description

2025-02-21 09:20:30 +01:00

Kconfig.kexec

liveupdate: kho: move to kernel/liveupdate

2025-11-27 14:24:33 -08:00

Kconfig.locks

locking/qspinlock: Add contended_release tracepoint

2026-08-07 17:58:10 +02:00

Kconfig.preempt

preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS

2026-08-10 10:50:19 +02:00

kcov.c

kcov: use WRITE_ONCE() for selftest mode stores

2026-06-04 14:49:26 -07:00

kexec_core.c

liveupdate: skip serialization for context-preserving kexec

2026-06-01 09:19:38 +03:00

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-03-16 22:30:47 -07:00

kexec_file.c

kexec_file: skip checksum verification when safe

2026-07-01 13:01:08 +03:00

kexec_internal.h

kexec: enable CMA based contiguous allocation

2025-08-02 12:01:38 -07:00

kexec.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

kheaders.c

kheaders: Simplify attribute through __BIN_ATTR_SIMPLE_RO()

2024-12-24 09:46:49 +01:00

kprobes.c

kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()

2026-03-13 23:15:26 +09:00

kstack_erase.c

sysctl: remove __user qualifier from stack_erasing_sysctl buffer argument

2025-11-27 15:44:53 +01:00

ksyms_common.c

…

ksysfs.c

kernel: ksysfs: initialize kernel_kobj earlier

2026-04-03 19:39:52 +02:00

kthread.c

exec_state: relocate dumpable information

2026-05-26 11:02:01 +02:00

latencytop.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

Makefile

exec: introduce struct task_exec_state

2026-05-26 11:02:01 +02:00

module_signature.c

module: Give 'enum pkey_id_type' a more specific name

2026-03-24 21:42:37 +00:00

notifier.c

…

nscommon.c

nsfs: tighten permission checks for ns iteration ioctls

2026-02-27 22:00:08 +01:00

nsproxy.c

Merge tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-14 19:59:25 -07:00

nstree.c

nstree: tighten permission checks for listing

2026-02-27 22:00:11 +01:00

padata.c

padata: Put CPU offline callback in ONLINE section to allow failure

2026-03-22 11:17:59 +09:00

panic.c

bug/kunit: Core support for suppressing warning backtraces

2026-05-14 10:50:00 -06:00

params.c

kernel: param: initialize module_kset in a pure_initcall

2026-06-08 23:27:56 +02:00

pid_namespace.c

pid_namespace: allow opening pid_for_children before init was created

2026-03-20 14:44:26 +01:00

pid_sysctl.h

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

pid.c

pid: reject allocations through dead ancestor pid namespaces

2026-08-12 12:56:30 +02:00

profile.c

…

ptrace.c

exec_state: relocate dumpable information

2026-05-26 11:02:01 +02:00

range.c

…

reboot.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

regset.c

…

relay.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

resource_kunit.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

resource.c

resource: Make resource_alignment() input const resource

2026-06-23 12:08:51 -05:00

rseq.c

rseq: Reenable performance optimizations conditionally

2026-05-06 17:40:27 +02:00

scftorture.c

scftorture: Remove preempt_disable() in scftorture_invoke_one()

2026-07-16 09:24:56 +02:00

scs.c

scs: fix a wrong parameter in __scs_magic

2025-11-12 10:00:13 -08:00

seccomp.c

seccomp, treewide: Rename and convert __secure_computing() to return boolean

2026-07-12 12:38:02 +02:00

signal.c

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

2026-07-05 11:44:06 +02:00

smp.c

Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-18 15:29:53 -07:00

smpboot.c

sched/smp: Use the SMP version of idle_thread_set_boot_cpu()

2025-06-13 08:47:20 +02:00

smpboot.h

…

softirq.c

preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS

2026-08-10 10:50:19 +02:00

stacktrace.c

…

static_call_inline.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

static_call.c

…

stop_machine.c

stop_machine: Make stop_one_cpu_nowait() return void

2026-07-31 12:35:26 +02:00

sys_ni.c

time: Respect COMPAT_32BIT_TIME for old time type functions

2026-07-07 23:52:53 +02:00

sys.c

exec_state: relocate dumpable information

2026-05-26 11:02:01 +02:00

sysctl-test.c

sysctl: move u8 register test to lib/test_sysctl.c

2025-04-14 14:13:41 +02:00

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-03-26 09:32:19 +01:00

task_work.c

task_work: Fix NMI race condition

2025-10-29 10:29:54 +01:00

taskstats.c

taskstats: retain dead thread stats in TGID queries

2026-05-28 21:24:41 -07:00

torture.c

torture: Add torture_sched_set_normal() for user-specified nice values

2026-05-24 09:38:47 +02:00

tracepoint.c

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

2026-04-14 05:17:02 -04:00

tsacct.c

tsacct: skip all kernel threads

2026-01-26 19:07:13 -08:00

ucount.c

binfmt_misc: correctly account pre-opened interpreters

2026-08-03 23:36:18 +02:00

uid16.c

…

uid16.h

…

umh.c

fs: add umh argument to struct kernel_clone_args

2026-06-29 10:54:41 +02:00

up.c

smp: Refactor remote CPU selection in smp_call_function_any()

2026-07-16 09:24:55 +02:00

user_namespace.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

user-return-notifier.c

…

user.c

binfmt_misc: use RCU for the handler lookup

2026-08-03 10:08:36 +02:00

utsname_sysctl.c

treewide: const qualify ctl_tables where applicable

2025-01-28 13:48:37 +01:00

utsname.c

Merge tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 11:20:29 -07:00

vhost_task.c

vhost_task_create: kill unnecessary .exit_signal initialization

2026-06-10 02:17:00 -04:00

vmcore_info.c

Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-16 20:11:56 -07:00

watch_queue.c

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

watchdog_buddy.c

watchdog/hardlockup: improve buddy system detection timeliness

2026-03-27 21:19:47 -07:00

watchdog_perf.c

watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency

2026-02-08 00:13:35 -08:00

watchdog.c

watchdog/hardlockup: improve buddy system detection timeliness

2026-03-27 21:19:47 -07:00

workqueue_internal.h

workqueue: Show in-flight work item duration in stall diagnostics

2026-03-05 07:27:48 -10:00

workqueue.c

Merge tag 'wq-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

2026-06-17 11:57:44 +01:00