From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/acpi/fan_hwmon.c | 180 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 180 insertions(+) create mode 100644 drivers/acpi/fan_hwmon.c (limited to 'drivers/acpi/fan_hwmon.c') diff --git a/drivers/acpi/fan_hwmon.c b/drivers/acpi/fan_hwmon.c new file mode 100644 index 000000000..d3374f8f5 --- /dev/null +++ b/drivers/acpi/fan_hwmon.c @@ -0,0 +1,180 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * hwmon interface for the ACPI Fan driver. + * + * Copyright (C) 2024 Armin Wolf + */ + +#include +#include +#include +#include +#include +#include +#include + +#include "fan.h" + +static struct acpi_fan_fps *acpi_fan_get_current_fps(struct acpi_fan *fan, u64 control) +{ + unsigned int i; + + for (i = 0; i < fan->fps_count; i++) { + if (fan->fps[i].control == control) + return &fan->fps[i]; + } + + return NULL; +} + +static umode_t acpi_fan_hwmon_is_visible(const void *drvdata, enum hwmon_sensor_types type, + u32 attr, int channel) +{ + const struct acpi_fan *fan = drvdata; + unsigned int i; + + switch (type) { + case hwmon_fan: + switch (attr) { + case hwmon_fan_input: + return 0444; + case hwmon_fan_target: + /* Only acpi4 fans support fan control. */ + if (!fan->acpi4) + return 0; + + /* + * When in fine grain control mode, not every fan control value + * has an associated fan performance state. + */ + if (fan->fif.fine_grain_ctrl) + return 0; + + return 0444; + default: + return 0; + } + case hwmon_power: + switch (attr) { + case hwmon_power_input: + /* Only acpi4 fans support fan control. */ + if (!fan->acpi4) + return 0; + + /* + * When in fine grain control mode, not every fan control value + * has an associated fan performance state. + */ + if (fan->fif.fine_grain_ctrl) + return 0; + + /* + * When all fan performance states contain no valid power data, + * when the associated attribute should not be created. + */ + for (i = 0; i < fan->fps_count; i++) { + if (acpi_fan_power_valid(fan->fps[i].power)) + return 0444; + } + + return 0; + default: + return 0; + } + default: + return 0; + } +} + +static int acpi_fan_hwmon_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, + int channel, long *val) +{ + struct acpi_fan *fan = dev_get_drvdata(dev); + struct acpi_fan_fps *fps; + struct acpi_fan_fst fst; + int ret; + + ret = acpi_fan_get_fst(fan->handle, &fst); + if (ret < 0) + return ret; + + switch (type) { + case hwmon_fan: + switch (attr) { + case hwmon_fan_input: + if (!acpi_fan_speed_valid(fst.speed)) + return -ENODEV; + + if (fst.speed > LONG_MAX) + return -EOVERFLOW; + + *val = fst.speed; + return 0; + case hwmon_fan_target: + fps = acpi_fan_get_current_fps(fan, fst.control); + if (!fps) + return -EIO; + + if (fps->speed > LONG_MAX) + return -EOVERFLOW; + + *val = fps->speed; + return 0; + default: + return -EOPNOTSUPP; + } + case hwmon_power: + switch (attr) { + case hwmon_power_input: + fps = acpi_fan_get_current_fps(fan, fst.control); + if (!fps) + return -EIO; + + if (!acpi_fan_power_valid(fps->power)) + return -ENODEV; + + if (fps->power > LONG_MAX / MICROWATT_PER_MILLIWATT) + return -EOVERFLOW; + + *val = fps->power * MICROWATT_PER_MILLIWATT; + return 0; + default: + return -EOPNOTSUPP; + } + default: + return -EOPNOTSUPP; + } +} + +static const struct hwmon_ops acpi_fan_hwmon_ops = { + .is_visible = acpi_fan_hwmon_is_visible, + .read = acpi_fan_hwmon_read, +}; + +static const struct hwmon_channel_info * const acpi_fan_hwmon_info[] = { + HWMON_CHANNEL_INFO(fan, HWMON_F_INPUT | HWMON_F_TARGET), + HWMON_CHANNEL_INFO(power, HWMON_P_INPUT), + NULL +}; + +static const struct hwmon_chip_info acpi_fan_hwmon_chip_info = { + .ops = &acpi_fan_hwmon_ops, + .info = acpi_fan_hwmon_info, +}; + +void acpi_fan_notify_hwmon(struct device *dev) +{ + struct acpi_fan *fan = dev_get_drvdata(dev); + + hwmon_notify_event(fan->hdev, hwmon_fan, hwmon_fan_input, 0); +} + +int devm_acpi_fan_create_hwmon(struct device *dev) +{ + struct acpi_fan *fan = dev_get_drvdata(dev); + + fan->hdev = devm_hwmon_device_register_with_info(dev, "acpi_fan", fan, + &acpi_fan_hwmon_chip_info, NULL); + + return PTR_ERR_OR_ZERO(fan->hdev); +} -- cgit v1.3.1