selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 59 insertions, 0 deletions

diff --git a/drivers/pinctrl/sprd/pinctrl-sprd.h b/drivers/pinctrl/sprd/pinctrl-sprd.h
new file mode 100644
index 000000000..190bcdb3b
--- /dev/null
+++ b/drivers/pinctrl/sprd/pinctrl-sprd.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Driver header file for pin controller driver
+ * Copyright (C) 2017 Spreadtrum  - http://www.spreadtrum.com
+ */
+
+#ifndef __PINCTRL_SPRD_H__
+#define __PINCTRL_SPRD_H__
+
+struct platform_device;
+
+#define NUM_OFFSET	(20)
+#define TYPE_OFFSET	(16)
+#define BIT_OFFSET	(8)
+#define WIDTH_OFFSET	(4)
+
+#define SPRD_PIN_INFO(num, type, offset, width, reg)	\
+		(((num) & 0xFFF) << NUM_OFFSET |	\
+		 ((type) & 0xF) << TYPE_OFFSET |	\
+		 ((offset) & 0xFF) << BIT_OFFSET |	\
+		 ((width) & 0xF) << WIDTH_OFFSET |	\
+		 ((reg) & 0xF))
+
+#define SPRD_PINCTRL_PIN(pin)	SPRD_PINCTRL_PIN_DATA(pin, #pin)
+
+#define SPRD_PINCTRL_PIN_DATA(a, b)				\
+	{							\
+		.name = b,					\
+		.num = (((a) >> NUM_OFFSET) & 0xfff),		\
+		.type = (((a) >> TYPE_OFFSET) & 0xf),		\
+		.bit_offset = (((a) >> BIT_OFFSET) & 0xff),	\
+		.bit_width = ((a) >> WIDTH_OFFSET & 0xf),	\
+		.reg = ((a) & 0xf)				\
+	}
+
+enum pin_type {
+	GLOBAL_CTRL_PIN,
+	COMMON_PIN,
+	MISC_PIN,
+};
+
+struct sprd_pins_info {
+	const char *name;
+	unsigned int num;
+	enum pin_type type;
+
+	/* for global control pins configuration */
+	unsigned long bit_offset;
+	unsigned long bit_width;
+	unsigned int reg;
+};
+
+int sprd_pinctrl_core_probe(struct platform_device *pdev,
+			    struct sprd_pins_info *sprd_soc_pin_info,
+			    int pins_cnt);
+void sprd_pinctrl_remove(struct platform_device *pdev);
+void sprd_pinctrl_shutdown(struct platform_device *pdev);
+
+#endif /* __PINCTRL_SPRD_H__ */