Re: [PATCH net v2 1/3] netdevsim: reject cls_bpf programs bound to another device

[Simon Horman <horms@kernel.org>]

On Sat, Oct 10, 2026 at 05:02:48PM -0400, Jamal Hadi Salim wrote:
> The issue:
> nsim_bpf_setup_tc_block_cb() installs any device-bound SCHED_CLS program
> without checking that its offload device matches the target netdev.  The
> core cls_bpf attach path rejects a mismatching program, but a netdev that
> joins a shared block later is replayed the stored filter by
> cls_bpf_reoffload() before it is inserted into block->ports, so the
> attach-time check cannot see it.  The driver callback is the
> authoritative per-device acceptance boundary and must enforce the match
> itself, as nfp already does in nfp_net_bpf_offload().
> 
> Without the check, replaying a device-bound program onto a different
> bpf_offload_dev installs it into that device's netdevsim state, which
> trips the WARN in nsim_bpf_uninit() (ns->bpf_offloaded set on a foreign
> device) and can dereference a NULL prog->aux->offload in
> nsim_prog_set_loaded().
> 
> The Fix:
> Reject a device-bound program whose offload device does not match the
> target netdev, with -EINVAL and an extack so the rejected replay is not
> silent.  The check is intentionally narrower than nfp's: it fires only
> for a dev-bound program, so nsim's bpf_tc_non_bound_accept mode (which
> admits an unbound program onto the device) is unaffected.  Teardown is
> never blocked: the guard is on the program being installed and an unbind
> passes cls_bpf.prog = NULL.
> 
> Conditions to recreate the bug:
>   - CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
>   - load and pin a dev-bound SCHED_CLS program for netdevsim device B
>   - install the program on a shared block owned by B
>   - add an independently backed netdevsim device C to that block; the
>     bind replays the filter to C's callback, and C's
>     ports/0/bpf_offloaded_id takes the B-bound program id.
> 
> The reported Sashiko review is at
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260809094418.901607-1-jhs@mojatatu.com
> 
> Fixes: 31d3ad832948 ("netdevsim: add bpf offload support")
> Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
> Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
> Cc: stable@vger.kernel.org
> Reviewed-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

Reviewed-by: Simon Horman <horms@kernel.org>