On Sun, 2026-08-16 at 16:17 -0700, Eduard Zingerman wrote: > On Sun, 2026-08-16 at 10:56 +0000, Yiyang Chen wrote: > > Add a verifier test with one atomic RMW instruction reached through > > PTR_TO_ARENA and PTR_TO_STACK paths. The verifier must reject the > > shared instruction with the existing incompatible-pointer diagnostic. > > > > Signed-off-by: Yiyang Chen <[email protected]> > > --- > > tools/testing/selftests/bpf/progs/verifier_arena.c | 39 > > ++++++++++++++++++++++ > > 1 file changed, 39 insertions(+) > > > > diff --git a/tools/testing/selftests/bpf/progs/verifier_arena.c > > b/tools/testing/selftests/bpf/progs/verifier_arena.c > > index b241bbcf54a8a..b22bab33301ab 100644 > > --- a/tools/testing/selftests/bpf/progs/verifier_arena.c > > +++ b/tools/testing/selftests/bpf/progs/verifier_arena.c > > @@ -637,6 +637,45 @@ int non_arena_ptr_add_to_arena_ptr(void *ctx) > > > > #endif > > > > +static const struct bpf_insn addr_space_cast_insn = { > > + .code = 0xbf, > > + .dst_reg = BPF_REG_7, > > + .src_reg = BPF_REG_7, > > + .off = 1, > > + .imm = 1, > > +}; > > + > > +SEC("socket") > > +__description("arena and stack atomic at the same instruction") > > +__failure __msg("same insn cannot be used with different pointers") > > +__arch_x86_64 > > +__load_if_JITed() > > +__naked void mixed_arena_stack_atomic(void) > > +{ > > + asm volatile (" \ > > + r1 = %[arena] ll; \ > > + r6 = r10; \ > > + r6 += -8; \ > > + r9 = 0; \ > > + *(u64 *)(r6 + 0) = r9; \ > > + r7 = 8192; \ > > + .8byte %[addr_space_cast]; \ > > I'm going to fix this to: > > r7 = addr_space_cast(r7, 0, 1); \ > > as in the test case above. > Waiting for CI [1]. > > [1] https://github.com/kernel-patches/bpf/pull/13325
A...and it requires another exception for GCC-BPF: https://github.com/kernel-patches/bpf/blob/bpf-next_base/ci/vmtest/configs/DENYLIST.test_progs-bpf_gcc Ihor, it's a third time GCC-BPF strikes this weekend. What do people think about downgrading it to may-fail until the DENYLIST decreases to something reasonable? Anyway, I'll wrap-up with this patch-set in the evening. > > + call %[bpf_get_prandom_u32]; \ > > + if w0 != 0 goto 1f; \ > > + r8 = r6; \ > > + goto 2f; \ > > +1: r8 = r7; \ > > +2: r9 = 1; \ > > + lock *(u64 *)(r8 + 0) += r9; \ > > + r0 = 0; \ > > + exit; \ > > +" : > > + : __imm_addr(arena), > > + __imm_insn(addr_space_cast, addr_space_cast_insn), > > + __imm(bpf_get_prandom_u32) > > + : __clobber_all); > > +} > > + > > static __noinline > > u32 __arena *check_arena_arg_nonglobal(u32 __arena *arg) > > {
