selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 148 insertions, 0 deletions

diff --git a/drivers/scsi/dmx3191d.c b/drivers/scsi/dmx3191d.c
new file mode 100644
index 000000000..d6d091b2f
--- /dev/null
+++ b/drivers/scsi/dmx3191d.c
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+    dmx3191d.c - driver for the Domex DMX3191D SCSI card.
+    Copyright (C) 2000 by Massimo Piccioni <dafastidio@libero.it>
+    Portions Copyright (C) 2004 by Christoph Hellwig <hch@lst.de>
+
+    Based on the generic NCR5380 driver by Drew Eckhardt et al.
+
+*/
+
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <asm/io.h>
+
+#include <scsi/scsi_host.h>
+
+/*
+ * Definitions for the generic 5380 driver.
+ */
+
+#define NCR5380_read(reg)		inb(hostdata->base + (reg))
+#define NCR5380_write(reg, value)	outb(value, hostdata->base + (reg))
+
+#define NCR5380_dma_xfer_len		NCR5380_dma_xfer_none
+#define NCR5380_dma_recv_setup		NCR5380_dma_setup_none
+#define NCR5380_dma_send_setup		NCR5380_dma_setup_none
+#define NCR5380_dma_residual		NCR5380_dma_residual_none
+
+#define NCR5380_implementation_fields	/* none */
+
+#include "NCR5380.h"
+#include "NCR5380.c"
+
+#define DMX3191D_DRIVER_NAME	"dmx3191d"
+#define DMX3191D_REGION_LEN	8
+
+
+static const struct scsi_host_template dmx3191d_driver_template = {
+	.module			= THIS_MODULE,
+	.proc_name		= DMX3191D_DRIVER_NAME,
+	.name			= "Domex DMX3191D",
+	.info			= NCR5380_info,
+	.queuecommand		= NCR5380_queue_command,
+	.eh_abort_handler	= NCR5380_abort,
+	.eh_host_reset_handler	= NCR5380_host_reset,
+	.can_queue		= 32,
+	.this_id		= 7,
+	.sg_tablesize		= SG_ALL,
+	.cmd_per_lun		= 2,
+	.dma_boundary		= PAGE_SIZE - 1,
+	.cmd_size		= sizeof(struct NCR5380_cmd),
+};
+
+static int dmx3191d_probe_one(struct pci_dev *pdev,
+			      const struct pci_device_id *id)
+{
+	struct Scsi_Host *shost;
+	struct NCR5380_hostdata *hostdata;
+	unsigned long io;
+	int error = -ENODEV;
+
+	if (pci_enable_device(pdev))
+		goto out;
+
+	io = pci_resource_start(pdev, 0);
+	if (!request_region(io, DMX3191D_REGION_LEN, DMX3191D_DRIVER_NAME)) {
+		printk(KERN_ERR "dmx3191: region 0x%lx-0x%lx already reserved\n",
+				io, io + DMX3191D_REGION_LEN);
+		goto out_disable_device;
+	}
+
+	shost = scsi_host_alloc(&dmx3191d_driver_template,
+			sizeof(struct NCR5380_hostdata));
+	if (!shost)
+		goto out_release_region;       
+
+	hostdata = shost_priv(shost);
+	hostdata->base = io;
+
+	/* This card does not seem to raise an interrupt on pdev->irq.
+	 * Steam-powered SCSI controllers run without an IRQ anyway.
+	 */
+	shost->irq = NO_IRQ;
+
+	error = NCR5380_init(shost, 0);
+	if (error)
+		goto out_host_put;
+
+	NCR5380_maybe_reset_bus(shost);
+
+	pci_set_drvdata(pdev, shost);
+
+	error = scsi_add_host(shost, &pdev->dev);
+	if (error)
+		goto out_exit;
+
+	scsi_scan_host(shost);
+	return 0;
+
+out_exit:
+	NCR5380_exit(shost);
+out_host_put:
+	scsi_host_put(shost);
+ out_release_region:
+	release_region(io, DMX3191D_REGION_LEN);
+ out_disable_device:
+	pci_disable_device(pdev);
+ out:
+	return error;
+}
+
+static void dmx3191d_remove_one(struct pci_dev *pdev)
+{
+	struct Scsi_Host *shost = pci_get_drvdata(pdev);
+	struct NCR5380_hostdata *hostdata = shost_priv(shost);
+	unsigned long io = hostdata->base;
+
+	scsi_remove_host(shost);
+
+	NCR5380_exit(shost);
+	scsi_host_put(shost);
+	release_region(io, DMX3191D_REGION_LEN);
+	pci_disable_device(pdev);
+}
+
+static const struct pci_device_id dmx3191d_pci_tbl[] = {
+	{PCI_VENDOR_ID_DOMEX, PCI_DEVICE_ID_DOMEX_DMX3191D,
+		PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
+	{ }
+};
+MODULE_DEVICE_TABLE(pci, dmx3191d_pci_tbl);
+
+static struct pci_driver dmx3191d_pci_driver = {
+	.name		= DMX3191D_DRIVER_NAME,
+	.id_table	= dmx3191d_pci_tbl,
+	.probe		= dmx3191d_probe_one,
+	.remove		= dmx3191d_remove_one,
+};
+
+module_pci_driver(dmx3191d_pci_driver);
+
+MODULE_AUTHOR("Massimo Piccioni <dafastidio@libero.it>");
+MODULE_DESCRIPTION("Domex DMX3191D SCSI driver");
+MODULE_LICENSE("GPL");