net: Add rx_skb of kfree_skb to raw_tp_null_args[].

JIRA: https://issues.redhat.com/browse/RHEL-96605
Conflicts:
- kernel/bpf/btf.c: Context difference due to already applied c83e2d9
  ("bpf: Add tracepoints with null-able arguments")

commit 5da7e15
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date:   Fri Jan 31 19:01:42 2025 -0800

    net: Add rx_skb of kfree_skb to raw_tp_null_args[].

    Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0]
    in trace_kfree_skb if the prog does not check if rx_sk is NULL.

    Commit c53795d ("net: add rx_sk to trace_kfree_skb") added
    rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL.

    Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier
    validate such a prog and prevent the issue.

    Now we fail to load such a prog:

      libbpf: prog 'drop': -- BEGIN PROG LOAD LOG --
      0: R1=ctx() R10=fp0
      ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21
      0: (79) r3 = *(u64 *)(r1 +24)
      func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock'
      1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1)
      ; bpf_printk("sk: %d, %d\n", sk, sk->__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24
      1: (69) r4 = *(u16 *)(r3 +16)
      R3 invalid mem access 'trusted_ptr_or_null_'
      processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
      -- END PROG LOAD LOG --

    Note this fix requires commit 838a10b ("bpf: Augment raw_tp
    arguments with PTR_MAYBE_NULL").

    [0]:
    BUG: kernel NULL pointer dereference, address: 0000000000000010
     PF: supervisor read access in kernel mode
     PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    PREEMPT SMP
    RIP: 0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d
    Call Trace:
     <TASK>
     ? __die+0x1f/0x60
     ? page_fault_oops+0x148/0x420
     ? search_bpf_extables+0x5b/0x70
     ? fixup_exception+0x27/0x2c0
     ? exc_page_fault+0x75/0x170
     ? asm_exc_page_fault+0x22/0x30
     ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d
     bpf_trace_run4+0x68/0xd0
     ? unix_stream_connect+0x1f4/0x6f0
     sk_skb_reason_drop+0x90/0x120
     unix_stream_connect+0x1f4/0x6f0
     __sys_connect+0x7f/0xb0
     __x64_sys_connect+0x14/0x20
     do_syscall_64+0x47/0xc30
     entry_SYSCALL_64_after_hwframe+0x4b/0x53

    Fixes: c53795d ("net: add rx_sk to trace_kfree_skb")
    Reported-by: Yan Zhai <yan@cloudflare.com>
    Closes: https://lore.kernel.org/netdev/Z50zebTRzI962e6X@debian.debian/
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Tested-by: Yan Zhai <yan@cloudflare.com>
    Acked-by: Jiri Olsa <jolsa@kernel.org>
    Link: https://lore.kernel.org/r/20250201030142.62703-1-kuniyu@amazon.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Signed-off-by: Felix Maurer <fmaurer@redhat.com>

Author: fmaurer-rh

kernel/bpf/btf.c

@@ -6509,6 +6509,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = {
 	{ "rxrpc_resend", 0x10 },
 	{ "rxrpc_tq", 0x10 },
 	{ "rxrpc_client", 0x1 },
+	/* skb */
+	{"kfree_skb", 0x1000},
 	/* sunrpc */
 	{ "xs_stream_read_data", 0x1 },
 	/* ... from xprt_cong_event event class */