From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/char/scx200_gpio.c | 132 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 drivers/char/scx200_gpio.c (limited to 'drivers/char/scx200_gpio.c') diff --git a/drivers/char/scx200_gpio.c b/drivers/char/scx200_gpio.c new file mode 100644 index 000000000..700e6affe --- /dev/null +++ b/drivers/char/scx200_gpio.c @@ -0,0 +1,132 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* linux/drivers/char/scx200_gpio.c + + National Semiconductor SCx200 GPIO driver. Allows a user space + process to play with the GPIO pins. + + Copyright (c) 2001,2002 Christer Weinigel */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#include +#include + +#define DRVNAME "scx200_gpio" + +static struct platform_device *pdev; + +MODULE_AUTHOR("Christer Weinigel "); +MODULE_DESCRIPTION("NatSemi/AMD SCx200 GPIO Pin Driver"); +MODULE_LICENSE("GPL"); + +static int major = 0; /* default to dynamic major */ +module_param(major, int, 0); +MODULE_PARM_DESC(major, "Major device number"); + +#define MAX_PINS 32 /* 64 later, when known ok */ + +struct nsc_gpio_ops scx200_gpio_ops = { + .owner = THIS_MODULE, + .gpio_config = scx200_gpio_configure, + .gpio_dump = nsc_gpio_dump, + .gpio_get = scx200_gpio_get, + .gpio_set = scx200_gpio_set, + .gpio_change = scx200_gpio_change, + .gpio_current = scx200_gpio_current +}; +EXPORT_SYMBOL_GPL(scx200_gpio_ops); + +static int scx200_gpio_open(struct inode *inode, struct file *file) +{ + unsigned m = iminor(inode); + file->private_data = &scx200_gpio_ops; + + if (m >= MAX_PINS) + return -EINVAL; + return nonseekable_open(inode, file); +} + +static int scx200_gpio_release(struct inode *inode, struct file *file) +{ + return 0; +} + +static const struct file_operations scx200_gpio_fileops = { + .owner = THIS_MODULE, + .write = nsc_gpio_write, + .read = nsc_gpio_read, + .open = scx200_gpio_open, + .release = scx200_gpio_release, +}; + +static struct cdev scx200_gpio_cdev; /* use 1 cdev for all pins */ + +static int __init scx200_gpio_init(void) +{ + int rc; + dev_t devid; + + if (!scx200_gpio_present()) { + printk(KERN_ERR DRVNAME ": no SCx200 gpio present\n"); + return -ENODEV; + } + + /* support dev_dbg() with pdev->dev */ + pdev = platform_device_alloc(DRVNAME, 0); + if (!pdev) + return -ENOMEM; + + rc = platform_device_add(pdev); + if (rc) + goto undo_malloc; + + /* nsc_gpio uses dev_dbg(), so needs this */ + scx200_gpio_ops.dev = &pdev->dev; + + if (major) { + devid = MKDEV(major, 0); + rc = register_chrdev_region(devid, MAX_PINS, "scx200_gpio"); + } else { + rc = alloc_chrdev_region(&devid, 0, MAX_PINS, "scx200_gpio"); + major = MAJOR(devid); + } + if (rc < 0) { + dev_err(&pdev->dev, "SCx200 chrdev_region err: %d\n", rc); + goto undo_platform_device_add; + } + + cdev_init(&scx200_gpio_cdev, &scx200_gpio_fileops); + cdev_add(&scx200_gpio_cdev, devid, MAX_PINS); + + return 0; /* succeed */ + +undo_platform_device_add: + platform_device_del(pdev); +undo_malloc: + platform_device_put(pdev); + + return rc; +} + +static void __exit scx200_gpio_cleanup(void) +{ + cdev_del(&scx200_gpio_cdev); + /* cdev_put(&scx200_gpio_cdev); */ + + unregister_chrdev_region(MKDEV(major, 0), MAX_PINS); + platform_device_unregister(pdev); +} + +module_init(scx200_gpio_init); +module_exit(scx200_gpio_cleanup); -- cgit v1.3.1