selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 155 insertions, 0 deletions

diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c
new file mode 100644
index 000000000..4ce81ac7f
--- /dev/null
+++ b/sound/ppc/keywest.c
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * common keywest i2c layer
+ *
+ * Copyright (c) by Takashi Iwai <tiwai@suse.de>
+ */
+
+
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <sound/core.h>
+#include "pmac.h"
+
+static struct pmac_keywest *keywest_ctx;
+static bool keywest_probed;
+
+static int keywest_probe(struct i2c_client *client)
+{
+	keywest_probed = true;
+	/* If instantiated via i2c-powermac, we still need to set the client */
+	if (!keywest_ctx->client)
+		keywest_ctx->client = client;
+	i2c_set_clientdata(client, keywest_ctx);
+	return 0;
+}
+
+/*
+ * This is kind of a hack, best would be to turn powermac to fixed i2c
+ * bus numbers and declare the sound device as part of platform
+ * initialization
+ */
+static int keywest_attach_adapter(struct i2c_adapter *adapter)
+{
+	struct i2c_board_info info;
+	struct i2c_client *client;
+
+	if (! keywest_ctx)
+		return -EINVAL;
+
+	if (strncmp(adapter->name, "mac-io", 6))
+		return -EINVAL; /* ignored */
+
+	memset(&info, 0, sizeof(struct i2c_board_info));
+	strscpy(info.type, "keywest", I2C_NAME_SIZE);
+	info.addr = keywest_ctx->addr;
+	client = i2c_new_client_device(adapter, &info);
+	if (IS_ERR(client))
+		return PTR_ERR(client);
+	keywest_ctx->client = client;
+
+	/*
+	 * We know the driver is already loaded, so the device should be
+	 * already bound. If not it means binding failed, and then there
+	 * is no point in keeping the device instantiated.
+	 */
+	if (!keywest_ctx->client->dev.driver) {
+		i2c_unregister_device(keywest_ctx->client);
+		keywest_ctx->client = NULL;
+		return -ENODEV;
+	}
+	
+	return 0;
+}
+
+static void keywest_remove(struct i2c_client *client)
+{
+	if (! keywest_ctx)
+		return;
+	if (client == keywest_ctx->client)
+		keywest_ctx->client = NULL;
+}
+
+
+static const struct i2c_device_id keywest_i2c_id[] = {
+	{ "MAC,tas3004" },	/* instantiated by i2c-powermac */
+	{ "keywest" },		/* instantiated by us if needed */
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, keywest_i2c_id);
+
+static struct i2c_driver keywest_driver = {
+	.driver = {
+		.name = "PMac Keywest Audio",
+	},
+	.probe = keywest_probe,
+	.remove = keywest_remove,
+	.id_table = keywest_i2c_id,
+};
+
+/* exported */
+void snd_pmac_keywest_cleanup(struct pmac_keywest *i2c)
+{
+	if (keywest_ctx && keywest_ctx == i2c) {
+		i2c_unregister_device(keywest_ctx->client);
+		i2c_del_driver(&keywest_driver);
+		keywest_ctx = NULL;
+	}
+}
+
+int snd_pmac_tumbler_post_init(void)
+{
+	int err;
+	
+	if (!keywest_ctx || !keywest_ctx->client)
+		return -ENXIO;
+
+	err = keywest_ctx->init_client(keywest_ctx);
+	if (err < 0) {
+		dev_err(&keywest_ctx->client->dev,
+			"tumbler: %i :cannot initialize the MCS\n", err);
+		return err;
+	}
+	return 0;
+}
+
+/* exported */
+int snd_pmac_keywest_init(struct pmac_keywest *i2c)
+{
+	struct i2c_adapter *adap;
+	int err, i = 0;
+
+	if (keywest_ctx)
+		return -EBUSY;
+
+	adap = i2c_get_adapter(0);
+	if (!adap)
+		return -EPROBE_DEFER;
+
+	keywest_ctx = i2c;
+
+	err = i2c_add_driver(&keywest_driver);
+	if (err) {
+		dev_err(&i2c->client->dev, "cannot register keywest i2c driver\n");
+		i2c_put_adapter(adap);
+		return err;
+	}
+
+	/* There was already a device from i2c-powermac. Great, let's return */
+	if (keywest_probed)
+		return 0;
+
+	/* We assume Macs have consecutive I2C bus numbers starting at 0 */
+	while (adap) {
+		/* Scan for devices to be bound to */
+		err = keywest_attach_adapter(adap);
+		if (!err)
+			return 0;
+		i2c_put_adapter(adap);
+		adap = i2c_get_adapter(++i);
+	}
+
+	return -ENODEV;
+}