From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/regulator/dummy.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 drivers/regulator/dummy.c (limited to 'drivers/regulator/dummy.c') diff --git a/drivers/regulator/dummy.c b/drivers/regulator/dummy.c new file mode 100644 index 000000000..c3e416fd3 --- /dev/null +++ b/drivers/regulator/dummy.c @@ -0,0 +1,72 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * dummy.c + * + * Copyright 2010 Wolfson Microelectronics PLC. + * + * Author: Mark Brown + * + * This is useful for systems with mixed controllable and + * non-controllable regulators, as well as for allowing testing on + * systems with no controllable regulators. + */ + +#include +#include +#include +#include +#include + +#include "dummy.h" + +struct regulator_dev *dummy_regulator_rdev; + +static const struct regulator_init_data dummy_initdata = { + .constraints = { + .always_on = 1, + }, +}; + +static const struct regulator_ops dummy_ops; + +static const struct regulator_desc dummy_desc = { + .name = "regulator-dummy", + .id = -1, + .type = REGULATOR_VOLTAGE, + .owner = THIS_MODULE, + .ops = &dummy_ops, +}; + +static int dummy_regulator_probe(struct faux_device *fdev) +{ + struct regulator_config config = { }; + int ret; + + config.dev = &fdev->dev; + config.init_data = &dummy_initdata; + + dummy_regulator_rdev = devm_regulator_register(&fdev->dev, &dummy_desc, + &config); + if (IS_ERR(dummy_regulator_rdev)) { + ret = PTR_ERR(dummy_regulator_rdev); + pr_err("Failed to register regulator: %d\n", ret); + return ret; + } + + return 0; +} + +static struct faux_device_ops dummy_regulator_driver = { + .probe = dummy_regulator_probe, +}; + +static struct faux_device *dummy_fdev; + +void __init regulator_dummy_init(void) +{ + dummy_fdev = faux_device_create("reg-dummy", NULL, &dummy_regulator_driver); + if (!dummy_fdev) { + pr_err("Failed to allocate dummy regulator device\n"); + return; + } +} -- cgit v1.3.1