From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- sound/soc/sof/stream-ipc.c | 131 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 131 insertions(+) create mode 100644 sound/soc/sof/stream-ipc.c (limited to 'sound/soc/sof/stream-ipc.c') diff --git a/sound/soc/sof/stream-ipc.c b/sound/soc/sof/stream-ipc.c new file mode 100644 index 000000000..78758cf58 --- /dev/null +++ b/sound/soc/sof/stream-ipc.c @@ -0,0 +1,131 @@ +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) +// +// This file is provided under a dual BSD/GPLv2 license. When using or +// redistributing this file, you may do so under either license. +// +// Copyright(c) 2019 Intel Corporation +// +// Authors: Guennadi Liakhovetski + +/* Generic SOF IPC code */ + +#include +#include +#include +#include + +#include +#include + +#include "ops.h" +#include "sof-priv.h" +#include "sof-audio.h" + +struct sof_stream { + size_t posn_offset; +}; + +/* Mailbox-based Generic IPC implementation */ +int sof_ipc_msg_data(struct snd_sof_dev *sdev, + struct snd_sof_pcm_stream *sps, + void *p, size_t sz) +{ + if (!sps || !sdev->stream_box.size) { + snd_sof_dsp_mailbox_read(sdev, sdev->dsp_box.offset, p, sz); + } else { + size_t posn_offset; + + if (sps->substream) { + struct sof_stream *stream = sps->substream->runtime->private_data; + + /* The stream might already be closed */ + if (!stream) + return -ESTRPIPE; + + posn_offset = stream->posn_offset; + } else if (sps->cstream) { + + struct sof_compr_stream *sstream = sps->cstream->runtime->private_data; + + if (!sstream) + return -ESTRPIPE; + + posn_offset = sstream->posn_offset; + + } else { + dev_err(sdev->dev, "%s: No stream opened\n", __func__); + return -EINVAL; + } + + snd_sof_dsp_mailbox_read(sdev, posn_offset, p, sz); + } + + return 0; +} +EXPORT_SYMBOL(sof_ipc_msg_data); + +int sof_set_stream_data_offset(struct snd_sof_dev *sdev, + struct snd_sof_pcm_stream *sps, + size_t posn_offset) +{ + /* check if offset is overflow or it is not aligned */ + if (posn_offset > sdev->stream_box.size || + posn_offset % sizeof(struct sof_ipc_stream_posn) != 0) + return -EINVAL; + + posn_offset += sdev->stream_box.offset; + + if (sps->substream) { + struct sof_stream *stream = sps->substream->runtime->private_data; + + stream->posn_offset = posn_offset; + dev_dbg(sdev->dev, "pcm: stream dir %d, posn mailbox offset is %zu", + sps->substream->stream, posn_offset); + } else if (sps->cstream) { + struct sof_compr_stream *sstream = sps->cstream->runtime->private_data; + + sstream->posn_offset = posn_offset; + dev_dbg(sdev->dev, "compr: stream dir %d, posn mailbox offset is %zu", + sps->cstream->direction, posn_offset); + } else { + dev_err(sdev->dev, "No stream opened"); + return -EINVAL; + } + + return 0; +} +EXPORT_SYMBOL(sof_set_stream_data_offset); + +int sof_stream_pcm_open(struct snd_sof_dev *sdev, + struct snd_pcm_substream *substream) +{ + struct sof_stream *stream = kmalloc_obj(*stream); + + if (!stream) + return -ENOMEM; + + /* binding pcm substream to hda stream */ + substream->runtime->private_data = stream; + + /* align to DMA minimum transfer size */ + snd_pcm_hw_constraint_step(substream->runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 4); + + /* avoid circular buffer wrap in middle of period */ + snd_pcm_hw_constraint_integer(substream->runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + + return 0; +} +EXPORT_SYMBOL(sof_stream_pcm_open); + +int sof_stream_pcm_close(struct snd_sof_dev *sdev, + struct snd_pcm_substream *substream) +{ + struct sof_stream *stream = substream->runtime->private_data; + + substream->runtime->private_data = NULL; + kfree(stream); + + return 0; +} +EXPORT_SYMBOL(sof_stream_pcm_close); -- cgit v1.3.1