selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 151 insertions, 0 deletions

diff --git a/Documentation/driver-api/index.rst b/Documentation/driver-api/index.rst
new file mode 100644
index 000000000..eaf7161ff
--- /dev/null
+++ b/Documentation/driver-api/index.rst
@@ -0,0 +1,151 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+==============================
+Driver implementer's API guide
+==============================
+
+The kernel offers a wide variety of interfaces to support the development
+of device drivers.  This document is an only somewhat organized collection
+of some of those interfaces — it will hopefully get better over time!  The
+available subsections can be seen below.
+
+
+General information for driver authors
+======================================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   basics
+   driver-model/index
+   device_link
+   infrastructure
+   ioctl
+   pm/index
+
+Useful support libraries
+========================
+
+This section contains documentation that should, at some point or other, be
+of interest to most developers working on device drivers.
+
+.. toctree::
+   :maxdepth: 1
+
+   early-userspace/index
+   connector
+   device-io
+   devfreq
+   dma-buf
+   component
+   io-mapping
+   io_ordering
+   uio-howto
+   vfio-mediated-device
+   vfio
+   vfio-pci-device-specific-driver-acceptance
+
+Bus-level documentation
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   auxiliary_bus
+   cxl/index
+   eisa
+   firewire
+   i3c/index
+   isa
+   men-chameleon-bus
+   pci/index
+   rapidio/index
+   slimbus
+   usb/index
+   virtio/index
+   vme
+   w1
+   xillybus
+
+
+Subsystem-specific APIs
+=======================
+
+.. toctree::
+   :maxdepth: 1
+
+   80211/index
+   acpi/index
+   backlight/lp855x-driver.rst
+   clk
+   coco/index
+   console
+   crypto/index
+   dmaengine/index
+   dpll
+   edac
+   extcon
+   firmware/index
+   fpga/index
+   frame-buffer
+   aperture
+   generic-counter
+   generic_pt
+   gpio/index
+   hsi
+   hte/index
+   hw-recoverable-errors
+   i2c
+   iio/index
+   infiniband
+   input
+   interconnect
+   ipmb
+   ipmi
+   libata
+   mailbox
+   md/index
+   media/index
+   mei/index
+   memory-devices/index
+   message-based
+   misc_devices
+   miscellaneous
+   mmc/index
+   mtd/index
+   mtdnand
+   nfc/index
+   ntb
+   nvdimm/index
+   nvmem
+   parport-lowlevel
+   phy/index
+   pin-control
+   pldmfw/index
+   pps
+   ptp
+   pwm
+   pwrseq
+   regulator
+   reset
+   rfkill
+   s390-drivers
+   scsi
+   serial/index
+   sm501
+   soundwire/index
+   spi
+   surface_aggregator/index
+   switchtec
+   sync_file
+   target
+   tee
+   thermal/index
+   tty/index
+   wbrf
+   wmi
+   xilinx/index
+   zorro