From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/video/console/dummycon.c | 159 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 159 insertions(+) create mode 100644 drivers/video/console/dummycon.c (limited to 'drivers/video/console/dummycon.c') diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c new file mode 100644 index 000000000..7d02470f1 --- /dev/null +++ b/drivers/video/console/dummycon.c @@ -0,0 +1,159 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/drivers/video/dummycon.c -- A dummy console driver + * + * To be used if there's no other console driver (e.g. for plain VGA text) + * available, usually until fbcon takes console over. + */ + +#include +#include +#include +#include +#include +#include +#include + +/* + * Dummy console driver + */ + +#if defined(CONFIG_ARCH_FOOTBRIDGE) && defined(CONFIG_VGA_CONSOLE) +#include +#define DUMMY_COLUMNS vgacon_screen_info.orig_video_cols +#define DUMMY_ROWS vgacon_screen_info.orig_video_lines +#else +/* set by Kconfig. Use 80x25 for 640x480 and 160x64 for 1280x1024 */ +#define DUMMY_COLUMNS CONFIG_DUMMY_CONSOLE_COLUMNS +#define DUMMY_ROWS CONFIG_DUMMY_CONSOLE_ROWS +#endif + +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER +/* These are both protected by the console_lock */ +static RAW_NOTIFIER_HEAD(dummycon_output_nh); +static bool dummycon_putc_called; + +void dummycon_register_output_notifier(struct notifier_block *nb) +{ + WARN_CONSOLE_UNLOCKED(); + + raw_notifier_chain_register(&dummycon_output_nh, nb); + + if (dummycon_putc_called) + nb->notifier_call(nb, 0, NULL); +} + +void dummycon_unregister_output_notifier(struct notifier_block *nb) +{ + WARN_CONSOLE_UNLOCKED(); + + raw_notifier_chain_unregister(&dummycon_output_nh, nb); +} + +static void dummycon_putc(struct vc_data *vc, u16 c, unsigned int y, + unsigned int x) +{ + WARN_CONSOLE_UNLOCKED(); + + dummycon_putc_called = true; + raw_notifier_call_chain(&dummycon_output_nh, 0, NULL); +} + +static void dummycon_putcs(struct vc_data *vc, const u16 *s, unsigned int count, + unsigned int ypos, unsigned int xpos) +{ + unsigned int i; + + if (!dummycon_putc_called) { + /* Ignore erases */ + for (i = 0 ; i < count; i++) { + if (s[i] != vc->vc_video_erase_char) + break; + } + if (i == count) + return; + + dummycon_putc_called = true; + } + + raw_notifier_call_chain(&dummycon_output_nh, 0, NULL); +} + +static bool dummycon_blank(struct vc_data *vc, enum vesa_blank_mode blank, + bool mode_switch) +{ + /* Redraw, so that we get putc(s) for output done while blanked */ + return true; +} + +static bool dummycon_switch(struct vc_data *vc) +{ + /* + * Redraw, so that we get putc(s) for output done while switched + * away. Informs deferred consoles to take over the display. + */ + return true; +} +#else +static void dummycon_putc(struct vc_data *vc, u16 c, unsigned int y, + unsigned int x) { } +static void dummycon_putcs(struct vc_data *vc, const u16 *s, unsigned int count, + unsigned int ypos, unsigned int xpos) { } +static bool dummycon_blank(struct vc_data *vc, enum vesa_blank_mode blank, + bool mode_switch) +{ + return false; +} +static bool dummycon_switch(struct vc_data *vc) +{ + return false; +} +#endif + +static const char *dummycon_startup(void) +{ + return "dummy device"; +} + +static void dummycon_init(struct vc_data *vc, bool init) +{ + vc->vc_can_do_color = 1; + if (init) { + vc->vc_cols = DUMMY_COLUMNS; + vc->vc_rows = DUMMY_ROWS; + } else + vc_resize(vc, DUMMY_COLUMNS, DUMMY_ROWS); +} + +static void dummycon_deinit(struct vc_data *vc) { } +static void dummycon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, + unsigned int width) { } +static void dummycon_cursor(struct vc_data *vc, bool enable) { } + +static bool dummycon_scroll(struct vc_data *vc, unsigned int top, + unsigned int bottom, enum con_scroll dir, + unsigned int lines) +{ + return false; +} + +/* + * The console `switch' structure for the dummy console + * + * Most of the operations are dummies. + */ + +const struct consw dummy_con = { + .owner = THIS_MODULE, + .con_startup = dummycon_startup, + .con_init = dummycon_init, + .con_deinit = dummycon_deinit, + .con_clear = dummycon_clear, + .con_putc = dummycon_putc, + .con_putcs = dummycon_putcs, + .con_cursor = dummycon_cursor, + .con_scroll = dummycon_scroll, + .con_switch = dummycon_switch, + .con_blank = dummycon_blank, +}; +EXPORT_SYMBOL_GPL(dummy_con); -- cgit v1.3.1