From: Jakub Kicinski <kuba@kernel.org>
To: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: netdev@vger.kernel.org, stable@vger.kernel.org, vega@nebusec.ai,
Victor Nogueira <victor@mojatatu.com>,
Quentin Monnet <qmo@kernel.org>, Simon Horman <horms@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
John Fastabend <john.fastabend@gmail.com>,
Stanislav Fomichev <sdf@fomichev.me>, Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Jiri Pirko <jiri@resnulli.us>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Paolo Abeni <pabeni@redhat.com>,
bpf@vger.kernel.org
Subject: Re: [PATCH net] net/sched: cls_bpf: reject dev-bound programs bound to a different device
Date: Tue, 11 Aug 2026 08:36:21 -0700 [thread overview]
Message-ID: <20260811083621.085021c9@kernel.org> (raw)
In-Reply-To: <CAM0EoMke_qk2jJdWW0rHvZcwMNd7RCG4xGkpNYZpPtrSKg2Q3A@mail.gmail.com>
On Tue, 11 Aug 2026 07:35:41 -0400 Jamal Hadi Salim wrote:
> It seems a v2 may be worth it:
> fix netdevsim's cls_bpf path (Fixes: 2b3486bc2d23), keep the core
> check as defense-in-depth without the bogus Fixes:, and walk
> block->ports for shared blocks (block->q is NULL there). Or drop the
> core change and fix only netdevsim. What says you?
Pls post the right Fixes tag in this thread (without wrapping etc)
my scripts will pick that up when applying.
re: blocks - don't care, those are a switch ACL feature to me.
for BPF offload - the offload mechanism itself already works
at the device level, so the program can be loaded once and then
bound to multiple ports. Or at least that's what I _think_ I did
cause NFP wouldn't have enough program storage for all the ports
it had :)
prev parent reply other threads:[~2026-08-11 15:36 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-09 9:44 [PATCH net] net/sched: cls_bpf: reject dev-bound programs bound to a different device Jamal Hadi Salim
2026-08-10 9:03 ` Daniel Borkmann
2026-08-11 0:05 ` Jakub Kicinski
2026-08-11 11:35 ` Jamal Hadi Salim
2026-08-11 15:36 ` Jakub Kicinski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260811083621.085021c9@kernel.org \
--to=kuba@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=qmo@kernel.org \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vega@nebusec.ai \
--cc=victor@mojatatu.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.