From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- arch/m68k/lib/memset.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 arch/m68k/lib/memset.c (limited to 'arch/m68k/lib/memset.c') diff --git a/arch/m68k/lib/memset.c b/arch/m68k/lib/memset.c new file mode 100644 index 000000000..8a7639f0a --- /dev/null +++ b/arch/m68k/lib/memset.c @@ -0,0 +1,74 @@ +/* + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file COPYING in the main directory of this archive + * for more details. + */ + +#include +#include + +void *memset(void *s, int c, size_t count) +{ + void *xs = s; + size_t temp; + + if (!count) + return xs; + c &= 0xff; + c |= c << 8; + c |= c << 16; + if ((long)s & 1) { + char *cs = s; + *cs++ = c; + s = cs; + count--; + } + if (count > 2 && (long)s & 2) { + short *ss = s; + *ss++ = c; + s = ss; + count -= 2; + } + temp = count >> 2; + if (temp) { + long *ls = s; +#if defined(CONFIG_M68000) || defined(CONFIG_COLDFIRE) + for (; temp; temp--) + *ls++ = c; +#else + size_t temp1; + asm volatile ( + " movel %1,%2\n" + " andw #7,%2\n" + " lsrl #3,%1\n" + " negw %2\n" + " jmp %%pc@(2f,%2:w:2)\n" + "1: movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + " movel %3,%0@+\n" + "2: dbra %1,1b\n" + " clrw %1\n" + " subql #1,%1\n" + " jpl 1b" + : "=a" (ls), "=d" (temp), "=&d" (temp1) + : "d" (c), "0" (ls), "1" (temp)); +#endif + s = ls; + } + if (count & 2) { + short *ss = s; + *ss++ = c; + s = ss; + } + if (count & 1) { + char *cs = s; + *cs = c; + } + return xs; +} +EXPORT_SYMBOL(memset); -- cgit v1.3.1