selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 79 insertions, 0 deletions

diff --git a/include/video/kyro.h b/include/video/kyro.h
new file mode 100644
index 000000000..418eef6c5
--- /dev/null
+++ b/include/video/kyro.h
@@ -0,0 +1,79 @@
+/*
+ *  linux/drivers/video/kyro/kryo.h
+ *
+ *  Copyright (C) 2002 STMicroelectronics
+ *  Copyright (C) 2004 Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+
+#ifndef _KYRO_H
+#define _KYRO_H
+
+struct kyrofb_info {
+	void __iomem *regbase;
+
+	u32 palette[16];
+	u32 HTot;	/* Hor Total Time    */
+	u32 HFP;	/* Hor Front Porch   */
+	u32 HST;	/* Hor Sync Time     */
+	u32 HBP;	/* Hor Back Porch    */
+	s32 HSP;		/* Hor Sync Polarity */
+	u32 VTot;	/* Ver Total Time    */
+	u32 VFP;	/* Ver Front Porch   */
+	u32 VST;	/* Ver Sync Time     */
+	u32 VBP;	/* Ver Back Porch    */
+	s32 VSP;		/* Ver Sync Polarity */
+	u32 XRES;	/* X Resolution      */
+	u32 YRES;	/* Y Resolution      */
+	u32 VFREQ;	/* Ver Frequency     */
+	u32 PIXCLK;	/* Pixel Clock       */
+	u32 HCLK;	/* Hor Clock         */
+
+	/* Useful to hold depth here for Linux */
+	u8 PIXDEPTH;
+
+	int wc_cookie;
+};
+
+/*
+ * benedict.gaster@superh.com
+ * Added the follow IOCTLS for the creation of overlay services...
+ */
+#define KYRO_IOC_MAGIC 'k'
+
+#define KYRO_IOCTL_OVERLAY_CREATE       _IO(KYRO_IOC_MAGIC, 0)
+#define KYRO_IOCTL_OVERLAY_VIEWPORT_SET _IO(KYRO_IOC_MAGIC, 1)
+#define KYRO_IOCTL_SET_VIDEO_MODE       _IO(KYRO_IOC_MAGIC, 2)
+#define KYRO_IOCTL_UVSTRIDE             _IO(KYRO_IOC_MAGIC, 3)
+#define KYRO_IOCTL_OVERLAY_OFFSET       _IO(KYRO_IOC_MAGIC, 4)
+#define KYRO_IOCTL_STRIDE               _IO(KYRO_IOC_MAGIC, 5)
+
+/*
+ * The follow 3 structures are used to pass data from user space into the kernel
+ * for the creation of overlay surfaces and setting the video mode.
+ */
+typedef struct _OVERLAY_CREATE {
+	u32 ulWidth;
+	u32 ulHeight;
+	int bLinear;
+} overlay_create;
+
+typedef struct _OVERLAY_VIEWPORT_SET {
+	u32 xOrgin;
+	u32 yOrgin;
+	u32 xSize;
+	u32 ySize;
+} overlay_viewport_set;
+
+typedef struct _SET_VIDEO_MODE {
+	u32 ulWidth;
+	u32 ulHeight;
+	u32 ulScan;
+	u8 displayDepth;
+	int bLinear;
+} set_video_mode;
+
+#endif /* _KYRO_H */