selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 153 insertions, 0 deletions

diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
new file mode 100644
index 000000000..16b71a23f
--- /dev/null
+++ b/fs/jfs/acl.c
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *   Copyright (C) International Business Machines  Corp., 2002-2004
+ *   Copyright (C) Andreas Gruenbacher, 2001
+ *   Copyright (C) Linus Torvalds, 1991, 1992
+ */
+
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/posix_acl_xattr.h>
+#include "jfs_incore.h"
+#include "jfs_txnmgr.h"
+#include "jfs_xattr.h"
+#include "jfs_acl.h"
+
+struct posix_acl *jfs_get_acl(struct inode *inode, int type, bool rcu)
+{
+	struct posix_acl *acl;
+	char *ea_name;
+	int size;
+	char *value = NULL;
+
+	if (rcu)
+		return ERR_PTR(-ECHILD);
+
+	switch(type) {
+		case ACL_TYPE_ACCESS:
+			ea_name = XATTR_NAME_POSIX_ACL_ACCESS;
+			break;
+		case ACL_TYPE_DEFAULT:
+			ea_name = XATTR_NAME_POSIX_ACL_DEFAULT;
+			break;
+		default:
+			return ERR_PTR(-EINVAL);
+	}
+
+	size = __jfs_getxattr(inode, ea_name, NULL, 0);
+
+	if (size > 0) {
+		value = kmalloc(size, GFP_KERNEL);
+		if (!value)
+			return ERR_PTR(-ENOMEM);
+		size = __jfs_getxattr(inode, ea_name, value, size);
+	}
+
+	if (size < 0) {
+		if (size == -ENODATA)
+			acl = NULL;
+		else
+			acl = ERR_PTR(size);
+	} else {
+		acl = posix_acl_from_xattr(&init_user_ns, value, size);
+	}
+	kfree(value);
+	return acl;
+}
+
+static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
+		       struct posix_acl *acl)
+{
+	char *ea_name;
+	int rc;
+	size_t size = 0;
+	char *value = NULL;
+
+	switch (type) {
+	case ACL_TYPE_ACCESS:
+		ea_name = XATTR_NAME_POSIX_ACL_ACCESS;
+		break;
+	case ACL_TYPE_DEFAULT:
+		ea_name = XATTR_NAME_POSIX_ACL_DEFAULT;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (acl) {
+		value = posix_acl_to_xattr(&init_user_ns, acl, &size, GFP_KERNEL);
+		if (!value)
+			return -ENOMEM;
+	}
+	rc = __jfs_setxattr(tid, inode, ea_name, value, size, 0);
+	kfree(value);
+
+	if (!rc)
+		set_cached_acl(inode, type, acl);
+
+	return rc;
+}
+
+int jfs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+		struct posix_acl *acl, int type)
+{
+	int rc;
+	tid_t tid;
+	int update_mode = 0;
+	struct inode *inode = d_inode(dentry);
+	umode_t mode = inode->i_mode;
+
+	tid = txBegin(inode->i_sb, 0);
+	mutex_lock(&JFS_IP(inode)->commit_mutex);
+	if (type == ACL_TYPE_ACCESS && acl) {
+		rc = posix_acl_update_mode(&nop_mnt_idmap, inode, &mode, &acl);
+		if (rc)
+			goto end_tx;
+		if (mode != inode->i_mode)
+			update_mode = 1;
+	}
+	rc = __jfs_set_acl(tid, inode, type, acl);
+	if (!rc) {
+		if (update_mode) {
+			inode->i_mode = mode;
+			inode_set_ctime_current(inode);
+			mark_inode_dirty(inode);
+		}
+		rc = txCommit(tid, 1, &inode, 0);
+	}
+end_tx:
+	txEnd(tid);
+	mutex_unlock(&JFS_IP(inode)->commit_mutex);
+	return rc;
+}
+
+int jfs_init_acl(tid_t tid, struct inode *inode, struct inode *dir)
+{
+	struct posix_acl *default_acl, *acl;
+	int rc = 0;
+
+	rc = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
+	if (rc)
+		return rc;
+
+	if (default_acl) {
+		rc = __jfs_set_acl(tid, inode, ACL_TYPE_DEFAULT, default_acl);
+		posix_acl_release(default_acl);
+	} else {
+		inode->i_default_acl = NULL;
+	}
+
+	if (acl) {
+		if (!rc)
+			rc = __jfs_set_acl(tid, inode, ACL_TYPE_ACCESS, acl);
+		posix_acl_release(acl);
+	} else {
+		inode->i_acl = NULL;
+	}
+
+	JFS_IP(inode)->mode2 = (JFS_IP(inode)->mode2 & 0xffff0000) |
+			       inode->i_mode;
+
+	return rc;
+}