From: "Alexei Starovoitov" <alexei.starovoitov@gmail•com>
To: "Jiayuan Chen" <jiayuan.chen@linux•dev>, <bpf@vger•kernel.org>
Cc: "Yinhao Hu" <dddddd@hust•edu.cn>,
"Kaiyan Mei" <M202472210@hust•edu.cn>,
"Dongliang Mu" <dzm91@hust•edu.cn>,
"Daniel Borkmann" <daniel@iogearbox•net>,
"Nikolay Aleksandrov" <razor@blackwall•org>,
"Andrew Lunn" <andrew+netdev@lunn•ch>,
"David S. Miller" <davem@davemloft•net>,
"Eric Dumazet" <edumazet@google•com>,
"Jakub Kicinski" <kuba@kernel•org>,
"Paolo Abeni" <pabeni@redhat•com>,
"Martin KaFai Lau" <martin.lau@linux•dev>,
"John Fastabend" <john.fastabend@gmail•com>,
"Stanislav Fomichev" <sdf@fomichev•me>,
"Alexei Starovoitov" <ast@kernel•org>,
"Andrii Nakryiko" <andrii@kernel•org>,
"Eduard Zingerman" <eddyz87@gmail•com>,
"Kumar Kartikeya Dwivedi" <memxor@gmail•com>,
"Song Liu" <song@kernel•org>,
"Yonghong Song" <yonghong.song@linux•dev>,
"Jiri Olsa" <jolsa@kernel•org>, "Simon Horman" <horms@kernel•org>,
"Jesper Dangaard Brouer" <hawk@kernel•org>,
"Willem de Bruijn" <willemb@google•com>,
"Samiullah Khawaja" <skhawaja@google•com>,
"Hangbin Liu" <liuhangbin@gmail•com>,
"Krishna Kumar" <krikku@gmail•com>,
"Kuniyuki Iwashima" <kuniyu@google•com>,
"Toke Høiland-Jørgensen" <toke@redhat•com>,
netdev@vger•kernel.org, linux-kernel@vger•kernel.org
Subject: Re: [PATCH bpf v2 1/3] bpf, tcx: reject offloaded programs on attach
Date: Fri, 24 Apr 2026 06:57:05 -0700 [thread overview]
Message-ID: <DI1FREJRMGWT.M8JZJADKO6WJ@gmail.com> (raw)
In-Reply-To: <20260424104201.217604-2-jiayuan.chen@linux.dev>
On Fri Apr 24, 2026 at 3:41 AM PDT, Jiayuan Chen wrote:
> An offloaded prog's bpf_func is replaced by bpf_prog_warn_on_exec(),
> since it's supposed to run on the NIC, not the host. But tcx doesn't
> check this and happily attaches it to the software path, so the first
> packet hits the WARN.
>
> XDP already guards this in dev_xdp_attach(); tcx just never got the
> same check. Add it to tcx_prog_attach(), tcx_link_attach() and also
> tcx_link_update() so the fix cannot be bypassed by loading a normal
> program and then swapping it out via BPF_LINK_UPDATE.
>
> Use bpf_prog_is_offloaded() rather than bpf_prog_is_dev_bound() +
> bpf_offload_dev_match() (as XDP does): bpf_prog_dev_bound_init()
> already rejects BPF_F_XDP_DEV_BOUND_ONLY for BPF_PROG_TYPE_SCHED_CLS,
> so a dev-bound SCHED_CLS program is always offloaded. The simpler
> check is sufficient and also rejects attaching a program offloaded to
> device A onto device B.
>
> Fixes: e420bed025071 ("bpf: Add fd-based tcx multi-prog infra with link support")
> Reported-by: Yinhao Hu <dddddd@hust•edu.cn>
> Reported-by: Kaiyan Mei <M202472210@hust•edu.cn>
> Reported-by: Dongliang Mu <dzm91@hust•edu.cn>
> Closes: https://lore.kernel.org/bpf/64d8e2b5-a214-4f3c-b9e8-bcedbcb2c602@hust.edu.cn/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux•dev>
> ---
> kernel/bpf/tcx.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/kernel/bpf/tcx.c b/kernel/bpf/tcx.c
> index 02db0113b8e7c..1144627483d53 100644
> --- a/kernel/bpf/tcx.c
> +++ b/kernel/bpf/tcx.c
> @@ -16,6 +16,9 @@ int tcx_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
> struct net_device *dev;
> int ret;
>
> + if (bpf_prog_is_offloaded(prog->aux))
> + return -EINVAL;
> +
instead of sprinkling the check everywhere do it at the source of the bug.
pw-bot: cr
next prev parent reply other threads:[~2026-04-24 13:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-24 10:41 [PATCH bpf v2 0/3] bpf: prevent offloaded programs from running on host via tcx/netkit Jiayuan Chen
2026-04-24 10:41 ` [PATCH bpf v2 1/3] bpf, tcx: reject offloaded programs on attach Jiayuan Chen
2026-04-24 13:57 ` Alexei Starovoitov [this message]
2026-04-24 10:41 ` [PATCH bpf v2 2/3] bpf, netkit: " Jiayuan Chen
2026-04-24 10:41 ` [PATCH bpf v2 3/3] bpf, xdp: reject offloaded programs on link update Jiayuan Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DI1FREJRMGWT.M8JZJADKO6WJ@gmail.com \
--to=alexei.starovoitov@gmail$(echo .)com \
--cc=M202472210@hust$(echo .)edu.cn \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=andrii@kernel$(echo .)org \
--cc=ast@kernel$(echo .)org \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=dddddd@hust$(echo .)edu.cn \
--cc=dzm91@hust$(echo .)edu.cn \
--cc=eddyz87@gmail$(echo .)com \
--cc=edumazet@google$(echo .)com \
--cc=hawk@kernel$(echo .)org \
--cc=horms@kernel$(echo .)org \
--cc=jiayuan.chen@linux$(echo .)dev \
--cc=john.fastabend@gmail$(echo .)com \
--cc=jolsa@kernel$(echo .)org \
--cc=krikku@gmail$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@google$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=liuhangbin@gmail$(echo .)com \
--cc=martin.lau@linux$(echo .)dev \
--cc=memxor@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=razor@blackwall$(echo .)org \
--cc=sdf@fomichev$(echo .)me \
--cc=skhawaja@google$(echo .)com \
--cc=song@kernel$(echo .)org \
--cc=toke@redhat$(echo .)com \
--cc=willemb@google$(echo .)com \
--cc=yonghong.song@linux$(echo .)dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox