Re: [PATCH v2] bpf, riscv: fix missing extable entry for arena load_acquire

[Björn Töpel]

Feng Jiang <jiangfeng@xxxxxxxxxx> writes:

> emit_atomic_ld_st() returns 1 to have build_body() skip the zext after
> a sub-word load_acquire. The caller does "ret = ret ?:
> add_exception_handler(...)", which skips add_exception_handler() on any
> non-zero ret, so the extable entry is missing and a faulting
> PROBE_ATOMIC load_acquire oopses.
>
> Check ret >= 0 before calling add_exception_handler(), and return ret
> unchanged so build_body() still skips the zext.
>
> Fixes: fb7cefabae81 ("riscv, bpf: Add support arena atomics for RV64")
> Suggested-by: Pu Lehui <pulehui@xxxxxxxxxx>
> Signed-off-by: Feng Jiang <jiangfeng@xxxxxxxxxx>
> ---
> Changes in v2:
> - Drop extra variable as suggested by Pu Lehui.
> - Link to v1: https://lore.kernel.org/r/20260716-bpf-riscv-fix-extable-v1-1-af023cc17af4@xxxxxxxxxx
> ---
>  arch/riscv/net/bpf_jit_comp64.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
> index f9d5347ba966..0db89093ff89 100644
> --- a/arch/riscv/net/bpf_jit_comp64.c
> +++ b/arch/riscv/net/bpf_jit_comp64.c
> @@ -1986,7 +1986,10 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
>  		else
>  			ret = emit_atomic_rmw(rd, rs, insn, ctx);
>  
> -		ret = ret ?: add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx);
> +		/* ret can be 1 (skip-zext); extable entry still needs to be added */
> +		if (ret >= 0)
> +			ret = add_exception_handler(insn, REG_DONT_CLEAR_MARKER, ctx) ?: ret;

I don't agree with Sashiko that this was fully pre-existing. This fix
changes the existing behaviour of BPF_DW | BPF_LOAD_ACQ. We can now end
up with stale register data.

I'd like to see a v3 that addresses REG_DONT_CLEAR_MARKER for atomic
loads (zext included).


Björn