selftests/bpf: Test rhtab kptr cancellation semanticsgrafted

Resizable hash-map updates and deletions must not perform full special-field
destruction in their caller context. In particular, a referenced kptr must
remain attached to the allocation until the memory allocator destructor can
release it safely.

Add separate coverage for both affected paths. The update test stores a task
kptr, replaces the ordinary value bytes with BPF_EXIST, and verifies that the
kptr survived. The delete test removes an element and exchanges its kptr
through the still-valid map-value pointer before the allocation is reclaimed.

Both cases observe a NULL kptr when rhtab uses bpf_obj_free_fields(). They
recover and release the reference after rhtab switches to cancellation
semantics.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ kkd: Split update and delete coverage and rewrote the commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904104203.345917-5-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 72 insertions, 0 deletions

diff --git a/drivers/eisa/virtual_root.c b/drivers/eisa/virtual_root.c
new file mode 100644
index 000000000..cd9515d9d
--- /dev/null
+++ b/drivers/eisa/virtual_root.c
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Virtual EISA root driver.
+ * Acts as a placeholder if we don't have a proper EISA bridge.
+ *
+ * (C) 2003 Marc Zyngier <maz@wild-wind.fr.eu.org>
+ */
+
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/eisa.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+
+#if defined(CONFIG_EISA_VLB_PRIMING)
+#define EISA_FORCE_PROBE_DEFAULT 1
+#else
+#define EISA_FORCE_PROBE_DEFAULT 0
+#endif
+
+static int force_probe = EISA_FORCE_PROBE_DEFAULT;
+static void virtual_eisa_release (struct device *);
+
+/* The default EISA device parent (virtual root device).
+ * Now use a platform device, since that's the obvious choice. */
+
+static struct platform_device eisa_root_dev = {
+	.name = "eisa",
+	.id   = 0,
+	.dev  = {
+		.release = virtual_eisa_release,
+	},
+};
+
+static struct eisa_root_device eisa_bus_root = {
+	.dev		= &eisa_root_dev.dev,
+	.bus_base_addr	= 0,
+	.res		= &ioport_resource,
+	.slots		= EISA_MAX_SLOTS,
+	.dma_mask	= 0xffffffff,
+};
+
+static void virtual_eisa_release (struct device *dev)
+{
+	/* nothing really to do here */
+}
+
+static int __init virtual_eisa_root_init (void)
+{
+	int r;
+
+	if ((r = platform_device_register (&eisa_root_dev)))
+		return r;
+
+	eisa_bus_root.force_probe = force_probe;
+
+	dev_set_drvdata(&eisa_root_dev.dev, &eisa_bus_root);
+
+	if (eisa_root_register (&eisa_bus_root)) {
+		/* A real bridge may have been registered before
+		 * us. So quietly unregister. */
+		platform_device_unregister (&eisa_root_dev);
+		return -1;
+	}
+
+	return 0;
+}
+
+module_param (force_probe, int, 0444);
+
+device_initcall (virtual_eisa_root_init);