selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 86 insertions, 0 deletions

diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
new file mode 100644
index 000000000..5c1eb46ef
--- /dev/null
+++ b/arch/mips/ralink/clk.c
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ *
+ *  Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2013 John Crispin <john@phrozen.org>
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/export.h>
+#include <linux/clkdev.h>
+#include <linux/clk.h>
+#include <linux/clk-provider.h>
+#include <asm/mach-ralink/ralink_regs.h>
+
+#include <asm/time.h>
+
+#include "common.h"
+
+static const char *clk_cpu(int *idx)
+{
+	switch (ralink_soc) {
+	case RT2880_SOC:
+		*idx = 1;
+		return "ralink,rt2880-sysc";
+	case RT3883_SOC:
+		*idx = 1;
+		return "ralink,rt3883-sysc";
+	case RT305X_SOC_RT3050:
+		*idx = 1;
+		return "ralink,rt3050-sysc";
+	case RT305X_SOC_RT3052:
+		*idx = 1;
+		return "ralink,rt3052-sysc";
+	case RT305X_SOC_RT3350:
+		*idx = 1;
+		return "ralink,rt3350-sysc";
+	case RT305X_SOC_RT3352:
+		*idx = 1;
+		return "ralink,rt3352-sysc";
+	case RT305X_SOC_RT5350:
+		*idx = 1;
+		return "ralink,rt5350-sysc";
+	case MT762X_SOC_MT7620A:
+		*idx = 2;
+		return "ralink,mt7620-sysc";
+	case MT762X_SOC_MT7620N:
+		*idx = 2;
+		return "ralink,mt7620-sysc";
+	case MT762X_SOC_MT7628AN:
+		*idx = 1;
+		return "ralink,mt7628-sysc";
+	case MT762X_SOC_MT7688:
+		*idx = 1;
+		return "ralink,mt7688-sysc";
+	default:
+		*idx = -1;
+		return "invalid";
+	}
+}
+
+void __init plat_time_init(void)
+{
+	struct of_phandle_args clkspec;
+	const char *compatible;
+	struct clk *clk;
+	int cpu_clk_idx;
+
+	ralink_of_remap();
+
+	compatible = clk_cpu(&cpu_clk_idx);
+	if (cpu_clk_idx == -1)
+		panic("unable to get CPU clock index");
+
+	of_clk_init(NULL);
+	clkspec.np = of_find_compatible_node(NULL, NULL, compatible);
+	clkspec.args_count = 1;
+	clkspec.args[0] = cpu_clk_idx;
+	clk = of_clk_get_from_provider(&clkspec);
+	if (IS_ERR(clk))
+		panic("unable to get CPU clock, err=%ld", PTR_ERR(clk));
+	pr_info("CPU Clock: %ldMHz\n", clk_get_rate(clk) / 1000000);
+	mips_hpt_frequency = clk_get_rate(clk) / 2;
+	clk_put(clk);
+	timer_probe();
+}