selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 113 insertions, 0 deletions

diff --git a/scripts/const_structs.checkpatch b/scripts/const_structs.checkpatch
new file mode 100644
index 000000000..6eb94fddc
--- /dev/null
+++ b/scripts/const_structs.checkpatch
@@ -0,0 +1,113 @@
+acpi_dock_ops
+address_space_operations
+backlight_ops
+bin_attribute
+block_device_operations
+bus_type
+clk_ops
+comedi_lrange
+component_ops
+ctl_table
+dentry_operations
+dev_pm_ops
+device_type
+dma_map_ops
+driver_info
+drm_connector_funcs
+drm_encoder_funcs
+drm_encoder_helper_funcs
+dvb_frontend_ops
+dvb_tuner_ops
+ethtool_ops
+extent_io_ops
+fb_ops
+file_lock_operations
+file_operations
+hv_ops
+hwmon_ops
+ib_device_ops
+ide_dma_ops
+ide_port_ops
+ieee80211_ops
+iio_buffer_setup_ops
+inode_operations
+intel_dvo_dev_ops
+irq_domain_ops
+item_operations
+iwl_cfg
+iwl_ops
+kernel_param_ops
+kgdb_arch
+kgdb_io
+kobj_type
+kset_uevent_ops
+lcd_ops
+lock_manager_operations
+machine_desc
+microcode_ops
+mlxsw_reg_info
+mtd_ooblayout_ops
+mtrr_ops
+nand_controller_ops
+neigh_ops
+net_device_ops
+nft_expr_ops
+nlmsvc_binding
+nvkm_device_chip
+of_device_id
+pci_raw_ops
+phy_ops
+pinconf_ops
+pinctrl_ops
+pinmux_ops
+pipe_buf_operations
+platform_hibernation_ops
+platform_suspend_ops
+proc_ops
+proto_ops
+pwm_ops
+reg_default
+reg_field
+reg_sequence
+regmap_access_table
+regmap_bus
+regmap_config
+regmap_irq
+regmap_irq_chip
+regmap_irq_sub_irq_map
+regmap_range
+regmap_range_cfg
+regulator_ops
+reset_control_ops
+rpc_pipe_ops
+rtc_class_ops
+sd_desc
+sdhci_ops
+seq_operations
+sirfsoc_padmux
+snd_ac97_build_ops
+snd_pcm_ops
+snd_rawmidi_ops
+snd_soc_component_driver
+snd_soc_dai_ops
+snd_soc_ops
+snd_soc_tplg_ops
+soc_pcmcia_socket_ops
+stacktrace_ops
+sysfs_ops
+tty_operations
+uart_ops
+usb_mon_operations
+v4l2_ctrl_ops
+v4l2_ioctl_ops
+v4l2_subdev_core_ops
+v4l2_subdev_internal_ops
+v4l2_subdev_ops
+v4l2_subdev_pad_ops
+v4l2_subdev_video_ops
+vb2_ops
+vm_operations_struct
+wacom_features
+watchdog_ops
+wd_ops
+xattr_handler