Atomic read-modify-write instructions are recorded as reads only, omitting their stack write effects from the may_write masks needed by SCEV. Record both read and write accesses for atomic RMW operations. Keep LOAD_ACQ read-only and STORE_REL write-only. Share the precise/imprecise stack-access dispatch so both accesses use the same address handling. Signed-off-by: Eduard Zingerman --- kernel/bpf/liveness.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c index b9b76684906e..ce74e3f16eef 100644 --- a/kernel/bpf/liveness.c +++ b/kernel/bpf/liveness.c @@ -1634,14 +1634,22 @@ static int record_load_store_access(struct bpf_verifier_env *env, break; case BPF_STX: if (BPF_MODE(insn->code) == BPF_ATOMIC) { - if (insn->imm == BPF_STORE_REL) - write = true; - else - read = true; - if (insn->imm == BPF_LOAD_ACQ) + switch (insn->imm) { + case BPF_LOAD_ACQ: ptr = &at[insn->src_reg]; - else + read = true; + break; + case BPF_STORE_REL: ptr = &at[insn->dst_reg]; + write = true; + break; + default: + /* ADD/AND/OR/XOR(+FETCH), XCHG, CMPXCHG */ + ptr = &at[insn->dst_reg]; + read = true; + write = true; + break; + } } else { ptr = &at[insn->dst_reg]; write = true; -- 2.53.0