ci/diffs: add a bugfix for veth driver

Link: https://lore.kernel.org/bpf/174964557873.519608.10855046105237280978.stgit@firesoul/
Signed-off-by: Ihor Solodrai <isolodrai@meta.com>

Author: theihor

ci/diffs/20250611-veth-prevent-NULL-pointer-dereference-in-veth_xdp_rc.patch

@@ -0,0 +1,52 @@
+From 5bfcfb00e0bd7314a9b86b55e1c7e009aa70111e Mon Sep 17 00:00:00 2001
+From: Jesper Dangaard Brouer <hawk@kernel.org>
+Date: Wed, 11 Jun 2025 14:40:04 +0200
+Subject: [PATCH] veth: prevent NULL pointer dereference in veth_xdp_rcv
+
+The veth peer device is RCU protected, but when the peer device gets
+deleted (veth_dellink) then the pointer is assigned NULL (via
+RCU_INIT_POINTER).
+
+This patch adds a necessary NULL check in veth_xdp_rcv when accessing
+the veth peer net_device.
+
+This fixes a bug introduced in commit dc82a33297fc ("veth: apply qdisc
+backpressure on full ptr_ring to reduce TX drops"). The bug is a race
+and only triggers when having inflight packets on a veth that is being
+deleted.
+
+Reported-by: Ihor Solodrai <ihor.solodrai@linux.dev>
+Closes: https://lore.kernel.org/all/fecfcad0-7a16-42b8-bff2-66ee83a6e5c4@linux.dev/
+Reported-by: syzbot+c4c7bf27f6b0c4bd97fe@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/683da55e.a00a0220.d8eae.0052.GAE@google.com/
+Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops")
+Signed-off-by: Jesper Dangaard Brouer <hawk@kernel.org>
+---
+ drivers/net/veth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index e58a0f1b5c5b..a3046142cb8e 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -909,7 +909,7 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,
+ 
+ 	/* NAPI functions as RCU section */
+ 	peer_dev = rcu_dereference_check(priv->peer, rcu_read_lock_bh_held());
+-	peer_txq = netdev_get_tx_queue(peer_dev, queue_idx);
++	peer_txq = peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL;
+ 
+ 	for (i = 0; i < budget; i++) {
+ 		void *ptr = __ptr_ring_consume(&rq->xdp_ring);
+@@ -959,7 +959,7 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget,
+ 	rq->stats.vs.xdp_packets += done;
+ 	u64_stats_update_end(&rq->stats.syncp);
+ 
+-	if (unlikely(netif_tx_queue_stopped(peer_txq)))
++	if (peer_txq && unlikely(netif_tx_queue_stopped(peer_txq)))
+ 		netif_tx_wake_queue(peer_txq);
+ 
+ 	return done;
+-- 
+2.49.0
+