On Thu, 2026-08-13 at 12:01 +0000, Yiyang Chen wrote:
> Atomic RMW verification records an instruction pointer type only when the
> current destination is PTR_TO_ARENA. A second path can therefore reach the
> same instruction with an ordinary pointer without comparing it against the
> saved arena type.
>
> The post-verification fixup uses the saved type to rewrite the instruction
> to BPF_PROBE_ATOMIC for every path. Record the actual destination type for
> all atomic RMW paths so the existing mismatch check rejects incompatible
> uses of one instruction.
>
> Fixes: d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to
> x86 JIT")
> Signed-off-by: Yiyang Chen <[email protected]>
> ---
Acked-by: Eduard Zingerman <[email protected]>
Looks like this was the only missing case for save_aux_ptr_type().
I wonder if we should pull the save_aux_ptr_type() call from
it's current positions to do_check_insn() itself.
...
