s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again

JIRA: https://issues.redhat.com/browse/RHEL-110274

commit 6a5abf8
Author: Ilya Leoshkevich <iii@linux.ibm.com>
Date:   Wed Jul 16 21:35:06 2025 +0200

    s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
    
    Commit 7ded842 ("s390/bpf: Fix bpf_plt pointer arithmetic") has
    accidentally removed the critical piece of commit c730fce
    ("s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL"), causing
    intermittent kernel panics in e.g. perf's on_switch() prog to reappear.
    
    Restore the fix and add a comment.
    
    Fixes: 7ded842 ("s390/bpf: Fix bpf_plt pointer arithmetic")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
    Link: https://lore.kernel.org/r/20250716194524.48109-2-iii@linux.ibm.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    

Signed-off-by: Viktor Malik <vmalik@redhat.com>

Author: viktormalik

arch/s390/net/bpf_jit_comp.c

@@ -544,7 +544,15 @@ static void bpf_jit_plt(struct bpf_plt *plt, void *ret, void *target)
 {
 	memcpy(plt, &bpf_plt, sizeof(*plt));
 	plt->ret = ret;
-	plt->target = target;
+	/*
+	 * (target == NULL) implies that the branch to this PLT entry was
+	 * patched and became a no-op. However, some CPU could have jumped
+	 * to this PLT entry before patching and may be still executing it.
+	 *
+	 * Since the intention in this case is to make the PLT entry a no-op,
+	 * make the target point to the return label instead of NULL.
+	 */
+	plt->target = target ?: ret;
 }
 
 /*