selftests/bpf: Test packet range of pointers sharing an idgrafted

Add tests where two packet pointers share an id and tightening one
pointer's umax from its var_off would put it less than their constant
distance from the other's umax: with an index & 0x38 capped at 50, the
base pointer keeps umax 50, so the pointer 8 bytes further on must keep
umax 58, even though its known bits allow at most 56.

These refused a valid program or accepted an out-of-bounds access before
the fix:

- check the advanced copy, load through the base: valid, was refused;
- check the base, load the byte at base + 1 through a copy advanced by
  8: was accepted;
- check base + 4, load 4 bytes at base + 2 through base + 8: reads two
  bytes past the checked range, was accepted;
- the same as the second with data_meta pointers checked against data:
  was accepted.

These pass with and without the fix and cover nearby paths:

- subtract an unknown scalar from a checked pointer and load below it
  (the range is kept across a new id);
- reach a load through two paths whose checks cover 8 and 7 bytes after
  the loaded pointer; the second path must not be pruned by the first;
- spill a copy of a pointer, check the pointer, fill the copy and load
  one byte past the checked range: the load is refused, and the copy
  has the range of the check.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20261001145255.855630-2-alexei.starovoitov@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

1 files changed, 73 insertions, 0 deletions

diff --git a/include/sound/ak4531_codec.h b/include/sound/ak4531_codec.h
new file mode 100644
index 000000000..64402347d
--- /dev/null
+++ b/include/sound/ak4531_codec.h
@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef __SOUND_AK4531_CODEC_H
+#define __SOUND_AK4531_CODEC_H
+
+/*
+ *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
+ *  Universal interface for Audio Codec '97
+ *
+ *  For more details look to AC '97 component specification revision 2.1
+ *  by Intel Corporation (http://developer.intel.com).
+ */
+
+#include <sound/info.h>
+#include <sound/control.h>
+
+/*
+ *  ASAHI KASEI - AK4531 codec
+ *  - not really AC'97 codec, but it uses very similar interface as AC'97
+ */
+
+/*
+ *  AK4531 codec registers
+ */
+
+#define AK4531_LMASTER  0x00	/* master volume left */
+#define AK4531_RMASTER  0x01	/* master volume right */
+#define AK4531_LVOICE   0x02	/* channel volume left */
+#define AK4531_RVOICE   0x03	/* channel volume right */
+#define AK4531_LFM      0x04	/* FM volume left */
+#define AK4531_RFM      0x05	/* FM volume right */
+#define AK4531_LCD      0x06	/* CD volume left */
+#define AK4531_RCD      0x07	/* CD volume right */
+#define AK4531_LLINE    0x08	/* LINE volume left */
+#define AK4531_RLINE    0x09	/* LINE volume right */
+#define AK4531_LAUXA    0x0a	/* AUXA volume left */
+#define AK4531_RAUXA    0x0b	/* AUXA volume right */
+#define AK4531_MONO1    0x0c	/* MONO1 volume left */
+#define AK4531_MONO2    0x0d	/* MONO1 volume right */
+#define AK4531_MIC      0x0e	/* MIC volume */
+#define AK4531_MONO_OUT 0x0f	/* Mono-out volume */
+#define AK4531_OUT_SW1  0x10	/* Output mixer switch 1 */
+#define AK4531_OUT_SW2  0x11	/* Output mixer switch 2 */
+#define AK4531_LIN_SW1  0x12	/* Input left mixer switch 1 */
+#define AK4531_RIN_SW1  0x13	/* Input right mixer switch 1 */
+#define AK4531_LIN_SW2  0x14	/* Input left mixer switch 2 */
+#define AK4531_RIN_SW2  0x15	/* Input right mixer switch 2 */
+#define AK4531_RESET    0x16	/* Reset & power down */
+#define AK4531_CLOCK    0x17	/* Clock select */
+#define AK4531_AD_IN    0x18	/* AD input select */
+#define AK4531_MIC_GAIN 0x19	/* MIC amplified gain */
+
+struct snd_ak4531 {
+	void (*write) (struct snd_ak4531 *ak4531, unsigned short reg,
+		       unsigned short val);
+	void *private_data;
+	void (*private_free) (struct snd_ak4531 *ak4531);
+	/* --- */
+	unsigned char regs[0x20];
+	struct mutex reg_mutex;
+};
+
+int snd_ak4531_mixer(struct snd_card *card, struct snd_ak4531 *_ak4531,
+		     struct snd_ak4531 **rak4531);
+
+#ifdef CONFIG_PM
+void snd_ak4531_suspend(struct snd_ak4531 *ak4531);
+void snd_ak4531_resume(struct snd_ak4531 *ak4531);
+#else
+static inline void snd_ak4531_suspend(struct snd_ak4531 *ak4531) {}
+static inline void snd_ak4531_resume(struct snd_ak4531 *ak4531) {}
+#endif
+
+#endif /* __SOUND_AK4531_CODEC_H */