Re: [PATCH bpf-next 04/14] selftests/bpf: Add tests for arena access through numbers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: verifier rejects valid atomic RMW due to register aliasing in check_atomic_rmw
--

commit 3887e0dd2a26cbc2d80c4f160a7eb98315fcc18d
Author: Alexei Starovoitov <ast@kernel.org>

selftests/bpf: Add tests for arena access through numbers

This commit adds various tests for loading and storing through addresses
returned by bpf_arena_alloc_pages() without cast_kern. It includes tests
covering different sizes, atomic operations, and boundary conditions for
arena and non-arena pointers.

> diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_scalar.c b/tools/testing/selftests/bpf/progs/verifier_arena_scalar.c
> new file mode 100644
> index 0000000000000..bebc37f501b7e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_arena_scalar.c

[ ... ]

> +SEC("syscall")
> +__arena_scalar
> +__description("arena_scalar: xchg into the register that holds a pointer to stack")
> +__failure __msg("misaligned access off (0x0; 0xffffffffffffffff)+0 size 8")
> +__naked void xchg_into_stack_ptr(void)
> +{
> +	asm volatile ("					\
> +	r1 = %[arena] ll;				\
> +	r1 = 0;						\
> +	*(u64 *)(r10 - 8) = r1;				\
> +	r1 = r10;					\
> +	r1 += -8;					\
> +	.8byte %[xchg_insn]; /* r1 = xchg_64(r1 + 0, r1) */ \
> +	r0 = 0;						\
> +	exit;						\
> +"	:
> +	: __imm_addr(arena),
> +	  __imm_insn(xchg_insn, BPF_ATOMIC_OP(BPF_DW, BPF_XCHG, BPF_REG_1, BPF_REG_1, 0))
> +	: __clobber_all);
> +}

[Severity: Medium]
Does this test codify an incorrect verifier rejection?

It appears the BPF verifier incorrectly rejects valid atomic read-modify-write
operations (like xchg r1, [r1]) on non-arena pointers (like PTR_TO_STACK)
due to in-place register corruption.

Looking at kernel/bpf/verifier.c:check_atomic_rmw() at line 7312:

    /* load_reg may be dst_reg. Look at dst_reg before it's marked as unknown. */
    dst_reg = mem_access_reg(env, insn->dst_reg, &arena);

    load_reg = bpf_atomic_load_reg(insn);
    if (load_reg >= 0) {
        /* check and record load of old value */
        err = check_reg_arg(env, load_reg, DST_OP);

Since kernel/bpf/verifier.c:mem_access_reg() at line 7162 returns a live
reference to the register state for non-arena pointers:

    if (!is_arena_scalar(env, regno))
        return cur_regs(env) + regno;

Could this cause an aliasing bug when the live register is later mutated by
check_reg_arg(), leading to this test's misaligned access failure message?

This is where the verifier attempts to snapshot the destination register state
but fails to isolate it from the source register mutation.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930193127.2181684-1-alexei.starovoitov@gmail.com?part=4