selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 298 insertions, 0 deletions

diff --git a/fs/smb/client/smberr.h b/fs/smb/client/smberr.h
new file mode 100644
index 000000000..5c3415bf1
--- /dev/null
+++ b/fs/smb/client/smberr.h
@@ -0,0 +1,298 @@
+/* SPDX-License-Identifier: LGPL-2.1 */
+/*
+ *
+ *   Copyright (c) International Business Machines  Corp., 2002,2004
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   See Error Codes section of the SNIA CIFS Specification
+ *   for more information
+ *
+ */
+
+struct smb_to_posix_error {
+	__u16 smb_err;
+	int posix_code;
+};
+
+/* The request was successful. */
+#define SUCCESS	0x00
+/* Error is from the core DOS operating system set */
+#define ERRDOS	0x01
+/* Error is generated by the file server daemon */
+#define ERRSRV	0x02
+/* Error is a hardware error. */
+#define ERRHRD	0x03
+/* Command was not in the "SMB" format. */
+#define ERRCMD	0xFF
+
+/* The following error codes may be generated with the SUCCESS error class.*/
+
+/*#define SUCCESS	0	The request was successful. */
+
+/*
+ * The following error codes may be generated with the ERRDOS error class.
+ * The comment at the end of each definition indicates the POSIX error
+ * code; it is used to generate the `mapping_table_ERRDOS` array.
+ */
+
+/*
+ * Invalid function. The server did not
+ * recognize or could not perform a
+ * system call generated by the server,
+ * e.g., set the DIRECTORY attribute on
+ * a data file, invalid seek mode.
+ */
+#define ERRbadfunc		1	// -EINVAL
+/*
+ * File not found. The last component
+ * of a file's pathname could not be
+ * found.
+ */
+#define ERRbadfile		2	// -ENOENT
+/*
+ * Directory invalid. A directory
+ * component in a pathname could not be
+ * found.
+ */
+#define ERRbadpath		3	// -ENOTDIR
+/*
+ * Too many open files. The server has
+ * no file handles available.
+ */
+#define ERRnofids		4	// -EMFILE
+/*
+ * Access denied, the client's context
+ * does not permit the requested
+ * function. This includes the
+ * following conditions: invalid rename
+ * command, write to Fid open for read
+ * only, read on Fid open for write
+ * only, attempt to delete a non-empty
+ * directory
+ */
+#define ERRnoaccess		5	// -EACCES
+/*
+ * Invalid file handle. The file handle
+ * specified was not recognized by the
+ * server.
+ */
+#define ERRbadfid		6	// -EBADF
+/* Memory control blocks destroyed. */
+#define ERRbadmcb		7	// -EIO
+/*
+ * Insufficient server memory to
+ * perform the requested function.
+ */
+#define ERRnomem		8	// -EREMOTEIO
+/* Invalid memory block address. */
+#define ERRbadmem		9	// -EFAULT
+/* Invalid environment. */
+#define ERRbadenv		10	// -EFAULT
+/* Invalid format. */
+#define ERRbadformat		11	// -EINVAL
+/* Invalid open mode. */
+#define ERRbadaccess		12	// -EACCES
+/*
+ * Invalid data (generated only by
+ * IOCTL calls within the server).
+ */
+#define ERRbaddata		13	// -EIO
+/* Invalid drive specified. */
+#define ERRbaddrive		15	// -ENXIO
+/*
+ * A Delete Directory request attempted
+ * to remove the server's current
+ * directory.
+ */
+#define ERRremcd		16	// -EACCES
+/*
+ * Not same device (e.g., a cross
+ * volume rename was attempted
+ */
+#define ERRdiffdevice		17	// -EXDEV
+/*
+ * A File Search command can find no
+ * more files matching the specified
+ * criteria.
+ */
+#define ERRnofiles		18	// -ENOENT
+/* media is write protected */
+#define ERRwriteprot		19	// -EROFS
+#define ERRgeneral		31
+/*
+ * The sharing mode specified for an
+ * Open conflicts with existing FIDs on
+ * the file.
+ */
+#define ERRbadshare		32	// -EBUSY
+/*
+ * A Lock request conflicted with an
+ * existing lock or specified an
+ * invalid mode, or an Unlock requested
+ * attempted to remove a lock held by
+ * another process.
+ */
+#define ERRlock			33	// -EACCES
+#define ERRunsup		50	// -EINVAL
+#define ERRnosuchshare		67	// -ENXIO
+/*
+ * The file named in the request
+ * already exists.
+ */
+#define ERRfilexists		80	// -EEXIST
+#define ERRinvparm		87	// -EINVAL
+#define ERRdiskfull		112	// -ENOSPC
+#define ERRinvname		123	// -ENOENT
+#define ERRunknownlevel		124	// -EOPNOTSUPP
+#define ERRdirnotempty		145	// -ENOTEMPTY
+#define ERRnotlocked		158	// -ENOLCK
+#define ERRcancelviolation	173	// -ENOLCK
+#define ERRalreadyexists	183	// -EEXIST
+#define ERRbadpipe		230
+#define ERRpipebusy		231
+#define ERRpipeclosing		232
+#define ERRnotconnected		233
+#define ERRmoredata		234	// -EOVERFLOW
+#define ERReasnotsupported	282	// -EOPNOTSUPP
+/*
+ * The operation would cause a quota
+ * limit to be exceeded.
+ */
+#define ErrQuota		0x200	// -EDQUOT
+/*
+ * A link operation was performed on a
+ * pathname that was not a link.
+ */
+#define ErrNotALink		0x201	// -ENOLINK
+#define ERRnetlogonNotStarted	2455	// -ENOPROTOOPT
+
+/* Below errors are used internally (do not come over the wire) for passthrough
+   from STATUS codes to POSIX only  */
+#define ERRsymlink              0xFFFD	// -EOPNOTSUPP
+#define ErrTooManyLinks         0xFFFE	// -EMLINK
+
+/*
+ * The following error codes may be generated with the ERRSRV error class.
+ * The comment at the end of each definition indicates the POSIX error
+ * code; it is used to generate the `mapping_table_ERRSRV` array.
+ */
+
+/*
+ * Non-specific error code. It is
+ * returned under the following
+ * conditions: resource other than disk
+ * space exhausted (e.g. TIDs), first
+ * SMB command was not negotiate,
+ * multiple negotiates attempted, and
+ * internal server error.
+ */
+#define ERRerror		1	// -EIO
+/*
+ * Bad password - name/password pair in
+ * a TreeConnect or Session Setup are
+ * invalid.
+ */
+#define ERRbadpw		2	// -EACCES
+/*
+ * used for indicating DFS referral
+ * needed
+ */
+#define ERRbadtype		3	// -EREMOTE
+/*
+ * The client does not have the
+ * necessary access rights within the
+ * specified context for requested
+ * function.
+ */
+#define ERRaccess		4	// -EACCES
+/*
+ * The Tid specified in a command was
+ * invalid.
+ */
+#define ERRinvtid		5	// -ENXIO
+/*
+ * Invalid network name in tree
+ * connect.
+ */
+#define ERRinvnetname		6	// -ENXIO
+/*
+ * Invalid device - printer request
+ * made to non-printer connection or
+ * non-printer request made to printer
+ * connection.
+ */
+#define ERRinvdevice		7	// -ENXIO
+/*
+ * Print queue full (files) -- returned
+ * by open print file.
+ */
+#define ERRqfull		49	// -ENOSPC
+/* Print queue full -- no space. */
+#define ERRqtoobig		50	// -ENOSPC
+/* EOF on print queue dump */
+#define ERRqeof			51	// -EIO
+/* Invalid print file FID. */
+#define ERRinvpfid		52	// -EBADF
+/*
+ * The server did not recognize the
+ * command received.
+ */
+#define ERRsmbcmd		64	// -EBADRQC
+/*
+ * The server encountered an internal
+ * error, e.g., system file
+ * unavailable.
+ */
+#define ERRsrverror		65	// -EIO
+/* (obsolete) */
+#define ERRbadBID		66	// -EIO
+/*
+ * The Fid and pathname parameters
+ * contained an invalid combination of
+ * values.
+ */
+#define ERRfilespecs		67	// -EINVAL
+/* (obsolete) */
+#define ERRbadLink		68	// -EIO
+/*
+ * The access permissions specified for
+ * a file or directory are not a valid
+ * combination.
+ */
+#define ERRbadpermits		69	// -EINVAL
+#define ERRbadPID		70	// -ESRCH
+/* attribute (mode) is invalid */
+#define ERRsetattrmode		71	// -EINVAL
+/* Server is paused */
+#define ERRpaused		81	// -EHOSTDOWN
+/* reserved - messaging off */
+#define ERRmsgoff		82	// -EHOSTDOWN
+/* reserved - no room for message */
+#define ERRnoroom		83	// -ENOSPC
+/* reserved - too many remote names */
+#define ERRrmuns		87	// -EUSERS
+/* operation timed out */
+#define ERRtimeout		88	// -ETIME
+/* No resources available for request */
+#define ERRnoresource		89	// -EREMOTEIO
+/* Too many UIDs active on this session */
+#define ERRtoomanyuids		90	// -EUSERS
+/* The UID is not known as a valid user */
+#define ERRbaduid		91	// -EACCES
+/* temporarily unable to use raw */
+#define ERRusempx		250	// -EIO
+/*
+ * temporarily unable to use either raw
+ * or mpx
+ */
+#define ERRusestd		251	// -EIO
+#define ERR_NOTIFY_ENUM_DIR	1024	// -ENOBUFS
+/* user account does not exist */
+#define ERRnoSuchUser		2238	// -EACCES
+#define ERRaccountexpired	2239	// -EKEYEXPIRED
+/* can not logon from this client */
+#define ERRbadclient		2240	// -EACCES
+/* logon hours do not allow this */
+#define ERRbadLogonTime		2241	// -EACCES
+#define ERRpasswordExpired	2242	// -EKEYEXPIRED
+#define ERRnosupport		0xFFFF	// -EINVAL