selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 220 insertions, 0 deletions

diff --git a/fs/smb/server/compress.c b/fs/smb/server/compress.c
new file mode 100644
index 000000000..01d1771ff
--- /dev/null
+++ b/fs/smb/server/compress.c
@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * SMB2 compression support for ksmbd.
+ *
+ * Receive and send SMB 3.1.1 compression transforms using the common helpers.
+ *
+ * Copyright (C) 2026 Namjae Jeon <linkinjeon@kernel.org>
+ */
+#include <linux/slab.h>
+
+#include "compress.h"
+#include "smb_common.h"
+#include "../common/compress/lz77.h"
+
+#define SMB_COMPRESS_MIN_LEN	PAGE_SIZE
+
+/**
+ * ksmbd_decompress_request() - replace a compressed request with its SMB2 PDU
+ * @conn: connection which owns the current RFC1002 request buffer
+ *
+ * Derive the uncompressed size from the transform variant, enforce ksmbd's
+ * normal message limits, and ask the common decoder to validate every payload.
+ * On success, replace conn->request_buf with a regular RFC1002-framed SMB2
+ * message so the rest of the request path needs no compression awareness.
+ *
+ * Return: 0 on success, otherwise a negative errno.
+ */
+int ksmbd_decompress_request(struct ksmbd_conn *conn)
+{
+	struct smb2_compression_hdr *hdr;
+	unsigned int pdu_size = get_rfc1002_len(conn->request_buf);
+	u32 orig_size, offset, out_size;
+	u32 max_allowed_pdu_size;
+	char *buf, *out;
+	int rc;
+
+	if (pdu_size < sizeof(struct smb2_compression_hdr))
+		return -EINVAL;
+
+	if (conn->dialect != SMB311_PROT_ID ||
+	    conn->compress_algorithm == SMB3_COMPRESS_NONE)
+		return -EINVAL;
+
+	hdr = smb_get_msg(conn->request_buf);
+	if (hdr->ProtocolId != SMB2_COMPRESSION_TRANSFORM_ID)
+		return -EINVAL;
+
+	orig_size = le32_to_cpu(hdr->OriginalCompressedSegmentSize);
+	/*
+	 * For chained transforms the top-level header is only eight bytes; the
+	 * Flags field overlays the first payload header. Reject unknown Flags
+	 * and unnegotiated chained mode before allocating the output buffer.
+	 */
+	if (hdr->Flags == cpu_to_le16(SMB2_COMPRESSION_FLAG_CHAINED)) {
+		if (!conn->compress_chained)
+			return -EINVAL;
+		out_size = orig_size;
+	} else if (hdr->Flags == cpu_to_le16(SMB2_COMPRESSION_FLAG_NONE)) {
+		offset = le32_to_cpu(hdr->Offset);
+		if (offset > pdu_size - sizeof(*hdr) ||
+		    check_add_overflow(orig_size, offset, &out_size))
+			return -EINVAL;
+	} else {
+		return -EINVAL;
+	}
+
+	max_allowed_pdu_size = ksmbd_max_allowed_pdu_size(conn);
+	if (out_size < sizeof(struct smb2_pdu) ||
+	    out_size > max_allowed_pdu_size ||
+	    out_size > MAX_STREAM_PROT_LEN)
+		return -EINVAL;
+
+	out = kvmalloc(out_size + 4 + 1, KSMBD_DEFAULT_GFP);
+	if (!out)
+		return -ENOMEM;
+
+	buf = (char *)hdr;
+	*(__be32 *)out = cpu_to_be32(out_size);
+	rc = smb_compression_decompress(conn->compress_algorithm,
+					conn->compress_chained,
+					conn->compress_pattern,
+					buf, pdu_size, out + 4, out_size);
+	if (rc) {
+		kvfree(out);
+		return rc;
+	}
+
+	kvfree(conn->request_buf);
+	conn->request_buf = out;
+	return 0;
+}
+
+/**
+ * ksmbd_compress_response() - compress an eligible ksmbd response
+ * @work: request work item containing the response iov
+ *
+ * Compression transforms describe one contiguous SMB2 message, while ksmbd
+ * builds responses from multiple iov entries. Flatten the response first,
+ * produce the negotiated transform, and replace the response iov only when the
+ * result is smaller than the original message.
+ *
+ * Encrypted and compound responses are intentionally left unchanged. The
+ * caller may still continue sending the original response when this function
+ * returns zero.
+ *
+ * Return: 1 if the response was replaced, 0 if compression was skipped, or a
+ * negative errno on failure.
+ */
+int ksmbd_compress_response(struct ksmbd_work *work)
+{
+	struct smb2_compression_hdr *chdr;
+	struct smb2_hdr *req_hdr;
+	u32 src_len, dst_len, compressed_pdu_len, max_dst_len;
+	u8 *src = NULL, *out = NULL, *p;
+	int i, rc;
+
+	if (!work->compress_response || work->encrypted ||
+	    work->conn->compress_algorithm != SMB3_COMPRESS_LZ77)
+		return 0;
+
+	req_hdr = smb_get_msg(work->request_buf);
+	if (req_hdr->NextCommand || work->next_smb2_rcv_hdr_off ||
+	    work->next_smb2_rsp_hdr_off)
+		return 0;
+
+	src_len = get_rfc1002_len(work->iov[0].iov_base);
+	if (src_len < SMB_COMPRESS_MIN_LEN)
+		return 0;
+
+	src = kvmalloc(src_len, KSMBD_DEFAULT_GFP);
+	if (!src)
+		return -ENOMEM;
+
+	p = src;
+	/* iov[0] contains only the RFC1002 length; the SMB2 PDU starts at iov[1]. */
+	for (i = 1; i < work->iov_cnt; i++) {
+		if (work->iov[i].iov_len > src + src_len - p) {
+			rc = -EINVAL;
+			goto out;
+		}
+		memcpy(p, work->iov[i].iov_base, work->iov[i].iov_len);
+		p += work->iov[i].iov_len;
+	}
+	if (p != src + src_len) {
+		rc = -EINVAL;
+		goto out;
+	}
+
+	max_dst_len = smb_lz77_compressed_alloc_size(src_len) +
+		sizeof(struct smb2_compression_hdr) +
+		3 * sizeof(struct smb2_compression_payload_hdr) +
+		2 * sizeof(struct smb2_compression_pattern_v1);
+	out = kvzalloc(sizeof(__be32) + max_dst_len,
+		       KSMBD_DEFAULT_GFP);
+	if (!out) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	if (work->conn->compress_chained) {
+		dst_len = max_dst_len;
+		rc = smb_compression_compress_chained(SMB3_COMPRESS_LZ77,
+						      work->conn->compress_pattern,
+						      src, src_len,
+						      out + sizeof(__be32),
+						      &dst_len);
+		if (rc == -EMSGSIZE || dst_len >= src_len) {
+			rc = 0;
+			goto out;
+		}
+		if (rc)
+			goto out;
+		compressed_pdu_len = dst_len;
+	} else {
+		/*
+		 * Peers which did not negotiate chained compression still use
+		 * the original 16-byte unchained transform format.
+		 */
+		dst_len = smb_lz77_compressed_alloc_size(src_len);
+		rc = smb_lz77_compress(src, src_len,
+				       out + sizeof(__be32) + sizeof(*chdr),
+				       &dst_len);
+		if (rc == -EMSGSIZE ||
+		    dst_len + sizeof(*chdr) >= src_len) {
+			rc = 0;
+			goto out;
+		}
+		if (rc)
+			goto out;
+
+		compressed_pdu_len = sizeof(*chdr) + dst_len;
+		chdr = (struct smb2_compression_hdr *)(out + sizeof(__be32));
+		chdr->ProtocolId = SMB2_COMPRESSION_TRANSFORM_ID;
+		chdr->OriginalCompressedSegmentSize = cpu_to_le32(src_len);
+		chdr->CompressionAlgorithm = SMB3_COMPRESS_LZ77;
+		chdr->Flags = cpu_to_le16(SMB2_COMPRESSION_FLAG_NONE);
+		chdr->Offset = 0;
+	}
+
+	*(__be32 *)out = cpu_to_be32(compressed_pdu_len);
+
+	/*
+	 * Keep the transform in work->compress_buf until send completion.
+	 * Existing response iovs can then be replaced without changing their
+	 * individual ownership rules.
+	 */
+	work->compress_buf = out;
+	work->iov[0].iov_base = out;
+	work->iov[0].iov_len = sizeof(__be32);
+	work->iov[1].iov_base = out + sizeof(__be32);
+	work->iov[1].iov_len = compressed_pdu_len;
+	work->iov_cnt = 2;
+	work->iov_idx = 1;
+	out = NULL;
+	rc = 1;
+out:
+	kvfree(out);
+	kvfree(src);
+	return rc;
+}