selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 107 insertions, 0 deletions

diff --git a/arch/arm/mach-pxa/reset.c b/arch/arm/mach-pxa/reset.c
new file mode 100644
index 000000000..49d2e46a1
--- /dev/null
+++ b/arch/arm/mach-pxa/reset.c
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/gpio/legacy.h>
+#include <linux/io.h>
+#include <asm/proc-fns.h>
+#include <asm/system_misc.h>
+
+#include "regs-ost.h"
+#include "reset.h"
+#include "smemc.h"
+#include "generic.h"
+
+static void do_hw_reset(void);
+
+static int reset_gpio = -1;
+
+int init_gpio_reset(int gpio, int output, int level)
+{
+	int rc;
+
+	rc = gpio_request(gpio, "reset generator");
+	if (rc) {
+		printk(KERN_ERR "Can't request reset_gpio\n");
+		goto out;
+	}
+
+	if (output)
+		rc = gpio_direction_output(gpio, level);
+	else
+		rc = gpio_direction_input(gpio);
+	if (rc) {
+		printk(KERN_ERR "Can't configure reset_gpio\n");
+		gpio_free(gpio);
+		goto out;
+	}
+
+out:
+	if (!rc)
+		reset_gpio = gpio;
+
+	return rc;
+}
+
+/*
+ * Trigger GPIO reset.
+ * This covers various types of logic connecting gpio pin
+ * to RESET pins (nRESET or GPIO_RESET):
+ */
+static void do_gpio_reset(void)
+{
+	BUG_ON(reset_gpio == -1);
+
+	/* drive it low */
+	gpio_direction_output(reset_gpio, 0);
+	mdelay(2);
+	/* rising edge or drive high */
+	gpio_set_value(reset_gpio, 1);
+	mdelay(2);
+	/* falling edge */
+	gpio_set_value(reset_gpio, 0);
+
+	/* give it some time */
+	mdelay(10);
+
+	WARN_ON(1);
+	/* fallback */
+	do_hw_reset();
+}
+
+static void do_hw_reset(void)
+{
+	/* Initialize the watchdog and let it fire */
+	writel_relaxed(OWER_WME, OWER);
+	writel_relaxed(OSSR_M3, OSSR);
+	/* ... in 100 ms */
+	writel_relaxed(readl_relaxed(OSCR) + 368640, OSMR3);
+	/*
+	 * SDRAM hangs on watchdog reset on Marvell PXA270 (erratum 71)
+	 * we put SDRAM into self-refresh to prevent that
+	 */
+	while (1)
+		writel_relaxed(MDREFR_SLFRSH, MDREFR);
+}
+
+void pxa_restart(enum reboot_mode mode, const char *cmd)
+{
+	local_irq_disable();
+	local_fiq_disable();
+
+	clear_reset_status(RESET_STATUS_ALL);
+
+	switch (mode) {
+	case REBOOT_SOFT:
+		/* Jump into ROM at address 0 */
+		soft_restart(0);
+		break;
+	case REBOOT_GPIO:
+		do_gpio_reset();
+		break;
+	case REBOOT_HARD:
+	default:
+		do_hw_reset();
+		break;
+	}
+}