Patch "bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-mark-bpf_dummy_struct_ops.test_1-parameter-as-nu.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5f4fbd5007dcca96f10df8d04320f79d4d8458f9
Author: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date:   Tue Apr 23 18:28:17 2024 -0700

    bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
    
    [ Upstream commit 1479eaff1f16983d8fda7c5a08a586c21891087d ]
    
    Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first
    parameter of the test_1() function. Mark this parameter as nullable to
    make verifier aware of such possibility.
    Otherwise, NULL check in the test_1() code:
    
          SEC("struct_ops/test_1")
          int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)
          {
                if (!state)
                        return ...;
    
                ... access state ...
          }
    
    Might be removed by verifier, thus triggering NULL pointer dereference
    under certain conditions.
    
    Reported-by: Jose E. Marchesi <jemarch@xxxxxxx>
    Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240424012821.595216-2-eddyz87@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bpf/bpf_dummy_struct_ops.c b/net/bpf/bpf_dummy_struct_ops.c
index de33dc1b0daad..fdbe30ad8db2f 100644
--- a/net/bpf/bpf_dummy_struct_ops.c
+++ b/net/bpf/bpf_dummy_struct_ops.c
@@ -230,7 +230,7 @@ static void bpf_dummy_unreg(void *kdata)
 {
 }
 
-static int bpf_dummy_test_1(struct bpf_dummy_ops_state *cb)
+static int bpf_dummy_ops__test_1(struct bpf_dummy_ops_state *cb__nullable)
 {
 	return 0;
 }
@@ -247,7 +247,7 @@ static int bpf_dummy_test_sleepable(struct bpf_dummy_ops_state *cb)
 }
 
 static struct bpf_dummy_ops __bpf_bpf_dummy_ops = {
-	.test_1 = bpf_dummy_test_1,
+	.test_1 = bpf_dummy_ops__test_1,
 	.test_2 = bpf_dummy_test_2,
 	.test_sleepable = bpf_dummy_test_sleepable,
 };