[PATCH bpf v4 0/2] bpf: reject direct access to nullable PTR_TO_BUF pointers

[Qi Tang <tpluszz77@gmail.com>]

check_mem_access() allows direct dereference of PTR_TO_BUF |
PTR_MAYBE_NULL without a null check, causing kernel NULL dereference
on map iterator stop callbacks.

Patch 1 adds the missing type_may_be_null() guard.
Patch 2 adds a selftest with a test runner.

Changes in v4:
  - Add test runner in prog_tests/ so the test is actually
    invoked by test_progs (Kumar)

Changes in v3:
  - Drop stack trace from commit log
  - Split kernel fix and selftest into separate patches
  - Use [PATCH bpf] prefix

Changes in v2:
  - Add selftest

Link: https://lore.kernel.org/bpf/20260402092923.38357-1-tpluszz77@gmail.com/ (v3)
Link: https://lore.kernel.org/all/20260401142316.2452-1-tpluszz77@gmail.com/ (v2)
Link: https://lore.kernel.org/all/20260331172720.29938-1-tpluszz77@gmail.com/ (v1)

Qi Tang (2):
  bpf: reject direct access to nullable PTR_TO_BUF pointers
  selftests/bpf: add test for nullable PTR_TO_BUF access

 kernel/bpf/verifier.c                                       |  3 ++-
 tools/testing/selftests/bpf/prog_tests/iter_buf_null_fail.c  |  9 +++++++++
 tools/testing/selftests/bpf/progs/iter_buf_null_fail.c       | 51 ++++++++++++
 3 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/iter_buf_null_fail.c
 create mode 100644 tools/testing/selftests/bpf/progs/iter_buf_null_fail.c