From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- arch/mips/bcm63xx/nvram.c | 98 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 arch/mips/bcm63xx/nvram.c (limited to 'arch/mips/bcm63xx/nvram.c') diff --git a/arch/mips/bcm63xx/nvram.c b/arch/mips/bcm63xx/nvram.c new file mode 100644 index 000000000..05757aed0 --- /dev/null +++ b/arch/mips/bcm63xx/nvram.c @@ -0,0 +1,98 @@ +/* + * This file is subject to the terms and conditions of the GNU General Public + * License. See the file "COPYING" in the main directory of this archive + * for more details. + * + * Copyright (C) 2008 Maxime Bizon + * Copyright (C) 2008 Florian Fainelli + * Copyright (C) 2012 Jonas Gorski + */ + +#define pr_fmt(fmt) "bcm63xx_nvram: " fmt + +#include +#include +#include +#include +#include +#include + +#include + +#define BCM63XX_DEFAULT_PSI_SIZE 64 + +static struct bcm963xx_nvram nvram; +static int mac_addr_used; + +void __init bcm63xx_nvram_init(void *addr) +{ + u32 crc, expected_crc; + u8 hcs_mac_addr[ETH_ALEN] = { 0x00, 0x10, 0x18, 0xff, 0xff, 0xff }; + + /* extract nvram data */ + memcpy(&nvram, addr, BCM963XX_NVRAM_V5_SIZE); + + /* check checksum before using data */ + if (bcm963xx_nvram_checksum(&nvram, &expected_crc, &crc)) + pr_warn("nvram checksum failed, contents may be invalid (expected %08x, got %08x)\n", + expected_crc, crc); + + /* Cable modems have a different NVRAM which is embedded in the eCos + * firmware and not easily extractible, give at least a MAC address + * pool. + */ + if (BCMCPU_IS_3368()) { + memcpy(nvram.mac_addr_base, hcs_mac_addr, ETH_ALEN); + nvram.mac_addr_count = 2; + } +} + +u8 *bcm63xx_nvram_get_name(void) +{ + return nvram.name; +} +EXPORT_SYMBOL(bcm63xx_nvram_get_name); + +int bcm63xx_nvram_get_mac_address(u8 *mac) +{ + u8 *oui; + int count; + + if (mac_addr_used >= nvram.mac_addr_count) { + pr_err("not enough mac addresses\n"); + return -ENODEV; + } + + memcpy(mac, nvram.mac_addr_base, ETH_ALEN); + oui = mac + ETH_ALEN/2 - 1; + count = mac_addr_used; + + while (count--) { + u8 *p = mac + ETH_ALEN - 1; + + do { + (*p)++; + if (*p != 0) + break; + p--; + } while (p != oui); + + if (p == oui) { + pr_err("unable to fetch mac address\n"); + return -ENODEV; + } + } + + mac_addr_used++; + return 0; +} +EXPORT_SYMBOL(bcm63xx_nvram_get_mac_address); + +int bcm63xx_nvram_get_psi_size(void) +{ + if (nvram.psi_size > 0) + return nvram.psi_size; + + return BCM63XX_DEFAULT_PSI_SIZE; +} +EXPORT_SYMBOL(bcm63xx_nvram_get_psi_size); -- cgit v1.3.1