From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/mtd/maps/pxa2xx-flash.c | 139 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 139 insertions(+) create mode 100644 drivers/mtd/maps/pxa2xx-flash.c (limited to 'drivers/mtd/maps/pxa2xx-flash.c') diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c new file mode 100644 index 000000000..bc303a990 --- /dev/null +++ b/drivers/mtd/maps/pxa2xx-flash.c @@ -0,0 +1,139 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Map driver for Intel XScale PXA2xx platforms. + * + * Author: Nicolas Pitre + * Copyright: (C) 2001 MontaVista Software Inc. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#define CACHELINESIZE 32 + +static void pxa2xx_map_inval_cache(struct map_info *map, unsigned long from, + ssize_t len) +{ + unsigned long start = (unsigned long)map->cached + from; + unsigned long end = start + len; + + start &= ~(CACHELINESIZE - 1); + while (start < end) { + /* invalidate D cache line */ + asm volatile ("mcr p15, 0, %0, c7, c6, 1" : : "r" (start)); + start += CACHELINESIZE; + } +} + +struct pxa2xx_flash_info { + struct mtd_info *mtd; + struct map_info map; +}; + +static const char * const probes[] = { "RedBoot", "cmdlinepart", NULL }; + +static int pxa2xx_flash_probe(struct platform_device *pdev) +{ + struct flash_platform_data *flash = dev_get_platdata(&pdev->dev); + struct pxa2xx_flash_info *info; + struct resource *res; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) + return -ENODEV; + + info = kzalloc_obj(struct pxa2xx_flash_info); + if (!info) + return -ENOMEM; + + info->map.name = flash->name; + info->map.bankwidth = flash->width; + info->map.phys = res->start; + info->map.size = resource_size(res); + + info->map.virt = ioremap(info->map.phys, info->map.size); + if (!info->map.virt) { + printk(KERN_WARNING "Failed to ioremap %s\n", + info->map.name); + kfree(info); + return -ENOMEM; + } + info->map.cached = ioremap_cache(info->map.phys, info->map.size); + if (!info->map.cached) + printk(KERN_WARNING "Failed to ioremap cached %s\n", + info->map.name); + info->map.inval_cache = pxa2xx_map_inval_cache; + simple_map_init(&info->map); + + printk(KERN_NOTICE + "Probing %s at physical address 0x%08lx" + " (%d-bit bankwidth)\n", + info->map.name, (unsigned long)info->map.phys, + info->map.bankwidth * 8); + + info->mtd = do_map_probe(flash->map_name, &info->map); + + if (!info->mtd) { + iounmap((void *)info->map.virt); + if (info->map.cached) + iounmap(info->map.cached); + kfree(info); + return -EIO; + } + info->mtd->dev.parent = &pdev->dev; + + mtd_device_parse_register(info->mtd, probes, NULL, flash->parts, + flash->nr_parts); + + platform_set_drvdata(pdev, info); + return 0; +} + +static void pxa2xx_flash_remove(struct platform_device *dev) +{ + struct pxa2xx_flash_info *info = platform_get_drvdata(dev); + + mtd_device_unregister(info->mtd); + + map_destroy(info->mtd); + iounmap(info->map.virt); + if (info->map.cached) + iounmap(info->map.cached); + kfree(info); +} + +#ifdef CONFIG_PM +static void pxa2xx_flash_shutdown(struct platform_device *dev) +{ + struct pxa2xx_flash_info *info = platform_get_drvdata(dev); + + if (info && mtd_suspend(info->mtd) == 0) + mtd_resume(info->mtd); +} +#else +#define pxa2xx_flash_shutdown NULL +#endif + +static struct platform_driver pxa2xx_flash_driver = { + .driver = { + .name = "pxa2xx-flash", + }, + .probe = pxa2xx_flash_probe, + .remove = pxa2xx_flash_remove, + .shutdown = pxa2xx_flash_shutdown, +}; + +module_platform_driver(pxa2xx_flash_driver); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Nicolas Pitre "); +MODULE_DESCRIPTION("MTD map driver for Intel XScale PXA2xx"); -- cgit v1.3.1