selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 88 insertions, 0 deletions

diff --git a/fs/coda/pioctl.c b/fs/coda/pioctl.c
new file mode 100644
index 000000000..36e35c155
--- /dev/null
+++ b/fs/coda/pioctl.c
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Pioctl operations for Coda.
+ * Original version: (C) 1996 Peter Braam
+ * Rewritten for Linux 2.1: (C) 1997 Carnegie Mellon University
+ *
+ * Carnegie Mellon encourages users of this code to contribute improvements
+ * to the Coda project. Contact Peter Braam <coda@cs.cmu.edu>.
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/stat.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/namei.h>
+#include <linux/module.h>
+#include <linux/uaccess.h>
+
+#include <linux/coda.h>
+#include "coda_psdev.h"
+#include "coda_linux.h"
+
+/* pioctl ops */
+static int coda_ioctl_permission(struct mnt_idmap *idmap,
+				 struct inode *inode, int mask);
+static long coda_pioctl(struct file *filp, unsigned int cmd,
+			unsigned long user_data);
+
+/* exported from this file */
+const struct inode_operations coda_ioctl_inode_operations = {
+	.permission	= coda_ioctl_permission,
+	.setattr	= coda_setattr,
+};
+
+const struct file_operations coda_ioctl_operations = {
+	.unlocked_ioctl	= coda_pioctl,
+	.llseek		= noop_llseek,
+};
+
+/* the coda pioctl inode ops */
+static int coda_ioctl_permission(struct mnt_idmap *idmap,
+				 struct inode *inode, int mask)
+{
+	return (mask & MAY_EXEC) ? -EACCES : 0;
+}
+
+static long coda_pioctl(struct file *filp, unsigned int cmd,
+			unsigned long user_data)
+{
+	struct path path;
+	int error;
+	struct PioctlData data;
+	struct inode *inode = file_inode(filp);
+	struct inode *target_inode = NULL;
+	struct coda_inode_info *cnp;
+
+	/* get the Pioctl data arguments from user space */
+	if (copy_from_user(&data, (void __user *)user_data, sizeof(data)))
+		return -EINVAL;
+
+	/*
+	 * Look up the pathname. Note that the pathname is in
+	 * user memory, and namei takes care of this
+	 */
+	error = user_path_at(AT_FDCWD, data.path,
+			     data.follow ? LOOKUP_FOLLOW : 0, &path);
+	if (error)
+		return error;
+
+	target_inode = d_inode(path.dentry);
+
+	/* return if it is not a Coda inode */
+	if (target_inode->i_sb != inode->i_sb) {
+		error = -EINVAL;
+		goto out;
+	}
+
+	/* now proceed to make the upcall */
+	cnp = ITOC(target_inode);
+
+	error = venus_pioctl(inode->i_sb, &(cnp->c_fid), cmd, &data);
+out:
+	path_put(&path);
+	return error;
+}