Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -6739,11 +6739,9 @@ static int check_atomic_rmw(struct bpf_verifier_env *env, · 6738 unmodified lines | |||
| 6739 | if (err) | 6739 | if (err) |
| 6740 | return err; | 6740 | return err; |
| 6741 | 6741 | ||
| 6742 | if (is_arena_reg(env, insn->dst_reg)) { | 6742 | err = save_aux_ptr_type(env, dst_reg->type, false); |
| 6743 | err = save_aux_ptr_type(env, PTR_TO_ARENA, false); | 6743 | if (err) |
| 6744 | if (err) | 6744 | return err; |
| 6745 | return err; | ||
| 6746 | } | ||
| 6747 | /* Check whether we can write into the same memory. */ | 6745 | /* Check whether we can write into the same memory. */ |
| 6748 | err = check_mem_access(env, env->insn_idx, dst_reg, argno_from_reg(insn->dst_reg), insn->off, | 6746 | err = check_mem_access(env, env->insn_idx, dst_reg, argno_from_reg(insn->dst_reg), insn->off, |
| 6749 | BPF_SIZE(insn->code), BPF_WRITE, -1, true, false); | 6747 | BPF_SIZE(insn->code), BPF_WRITE, -1, true, false); |