[PATCH bpf v2 2/3] bpf, netkit: reject offloaded programs on attach

Jiayuan Chen
2026-04-24T10:42:43Z

Same issue as the tcx fix: netkit accepts SCHED_CLS programs but never
checks if they were loaded for hardware offload. If someone loads a
program with prog_ifindex pointing to an offload-capable device and then
attaches it to a netkit peer, the bpf_func is bpf_prog_warn_on_exec()
and the first packet triggers the WARN.

Reject offloaded programs in netkit_prog_attach(), netkit_link_attach()
and netkit_link_update().

Fixes: 35dfaad7188cd ("netkit, bpf: Add bpf programmable net device")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
drivers/net/netkit.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c
index 5c0e01396e064..dae4d7b24d80e 100644
--- a/drivers/net/netkit.c
+++ b/drivers/net/netkit.c
@@ -533,6 +533,9 @@ int netkit_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
struct net_device *dev;
int ret;

+ if (bpf_prog_is_offloaded(prog->aux))
+ return -EINVAL;
+
rtnl_lock();
dev = netkit_dev_fetch(current->nsproxy->net_ns, attr->target_ifindex,
attr->attach_type);
@@ -683,6 +686,9 @@ static int netkit_link_update(struct bpf_link *link, struct bpf_prog *nprog,
struct net_device *dev;
int ret = 0;

+ if (bpf_prog_is_offloaded(nprog->aux))
+ return -EINVAL;
+
rtnl_lock();
dev = nkl->dev;
if (!dev) {
@@ -788,6 +794,9 @@ int netkit_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
struct net_device *dev;
int ret;

+ if (bpf_prog_is_offloaded(prog->aux))
+ return -EINVAL;
+
rtnl_lock();
dev = netkit_dev_fetch(current->nsproxy->net_ns,
attr->link_create.target_ifindex,
--
2.43.0