selftests/bpf: Reject graph kptr use after RCU unlockgrafted

Add a sleepable verifier test that loads a graph-node local kptr in an
explicit RCU read-side critical section, then passes its node to
bpf_rbtree_remove() after the section ends.

Before the verifier fix, the stale NON_OWN_REF flag makes the node look like
a live borrowed reference and the program is accepted. After the fix, the
pointer is demoted without NON_OWN_REF and the graph kfunc argument is
rejected.

Also exercise a graph kptr loaded while a spin lock provides implicit RCU
protection. The pointer must be invalidated when the lock is released, which
guards the required ordering between non-owning-reference invalidation and
RCU demotion.

Update the existing fault-protected load test state description. The
post-unlock pointer no longer carries NON_OWN_REF, but remains readable
because the load is rewritten to use BPF_PROBE_MEM.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 120 insertions, 0 deletions

diff --git a/virt/kvm/Kconfig b/virt/kvm/Kconfig
new file mode 100644
index 000000000..794976b88
--- /dev/null
+++ b/virt/kvm/Kconfig
@@ -0,0 +1,120 @@
+# SPDX-License-Identifier: GPL-2.0
+# KVM common configuration items and defaults
+
+config KVM_COMMON
+       bool
+       select EVENTFD
+       select INTERVAL_TREE
+       select MMU_NOTIFIER
+       select PREEMPT_NOTIFIERS
+
+config HAVE_KVM_PFNCACHE
+       bool
+
+config HAVE_KVM_IRQCHIP
+       bool
+
+config HAVE_KVM_IRQ_ROUTING
+       bool
+
+config HAVE_KVM_DIRTY_RING
+       bool
+
+# Only strongly ordered architectures can select this, as it doesn't
+# put any explicit constraint on userspace ordering. They can also
+# select the _ACQ_REL version.
+config HAVE_KVM_DIRTY_RING_TSO
+       bool
+       select HAVE_KVM_DIRTY_RING
+       depends on X86
+
+# Weakly ordered architectures can only select this, advertising
+# to userspace the additional ordering requirements.
+config HAVE_KVM_DIRTY_RING_ACQ_REL
+       bool
+       select HAVE_KVM_DIRTY_RING
+
+# Allow enabling both the dirty bitmap and dirty ring. Only architectures
+# that need to dirty memory outside of a vCPU context should select this.
+config NEED_KVM_DIRTY_RING_WITH_BITMAP
+	bool
+	depends on HAVE_KVM_DIRTY_RING
+
+config KVM_MMIO
+       bool
+
+config KVM_ASYNC_PF
+       bool
+
+# Toggle to switch between direct notification and batch job
+config KVM_ASYNC_PF_SYNC
+       bool
+
+config HAVE_KVM_MSI
+       bool
+
+config HAVE_KVM_READONLY_MEM
+       bool
+
+config HAVE_KVM_CPU_RELAX_INTERCEPT
+       bool
+
+config KVM_VFIO
+       bool
+
+config HAVE_KVM_INVALID_WAKEUPS
+       bool
+
+config KVM_GENERIC_DIRTYLOG_READ_PROTECT
+       bool
+
+config KVM_GENERIC_PRE_FAULT_MEMORY
+       bool
+
+config KVM_COMPAT
+       def_bool y
+       depends on KVM && COMPAT && !(S390 || ARM64 || RISCV)
+
+config HAVE_KVM_IRQ_BYPASS
+       tristate
+       select IRQ_BYPASS_MANAGER
+
+config HAVE_KVM_VCPU_RUN_PID_CHANGE
+       bool
+
+config HAVE_KVM_NO_POLL
+       bool
+
+config VIRT_XFER_TO_GUEST_WORK
+       bool
+
+config HAVE_KVM_PM_NOTIFIER
+       bool
+
+config KVM_GENERIC_HARDWARE_ENABLING
+       bool
+
+config KVM_ELIDE_TLB_FLUSH_IF_YOUNG
+       bool
+
+config KVM_MMU_LOCKLESS_AGING
+       bool
+
+config KVM_GENERIC_MEMORY_ATTRIBUTES
+       bool
+
+config KVM_GUEST_MEMFD
+       select XARRAY_MULTI
+       bool
+
+config HAVE_KVM_ARCH_GMEM_PREPARE
+       bool
+       depends on KVM_GUEST_MEMFD
+
+config HAVE_KVM_ARCH_GMEM_INVALIDATE
+       bool
+       depends on KVM_GUEST_MEMFD
+
+config HAVE_KVM_ARCH_GMEM_POPULATE
+       bool
+       depends on KVM_GUEST_MEMFD