Re: [PATCH bpf v2 1/3] bpf, tcx: reject offloaded programs on attach

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Low] The `bpf_prog_is_offloaded()` check added to `tcx_prog_attach()` is unreachable (dead code).
--

commit 4bde7a6b1e8fdca118910a3c0f4b35254f1c6e42
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf, tcx: reject offloaded programs on attach

This commit adds checks to prevent offloaded BPF programs from being
attached via tcx, as they are meant to run on the NIC rather than the
host. The guards are added to tcx_prog_attach(), tcx_link_attach(),
and tcx_link_update().

Closes: https://lore.kernel.org/bpf/64d8e2b5-a214-4f3c-b9e8-bcedbcb2c602@hust.edu.cn/

> diff --git a/kernel/bpf/tcx.c b/kernel/bpf/tcx.c
> index 02db0113b8e7c6..1144627483d53d 100644
> --- a/kernel/bpf/tcx.c
> +++ b/kernel/bpf/tcx.c
> @@ -16,6 +16,9 @@ int tcx_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  	struct net_device *dev;
>  	int ret;
>  
> +	if (bpf_prog_is_offloaded(prog->aux))
> +		return -EINVAL;
> +

Is it possible for an offloaded program to actually reach this check
in tcx_prog_attach()?

Looking at the prog attach syscall handler, it acquires the program
using bpf_prog_get_type(). This function hardcodes attach_drv = false
when calling __bpf_prog_get().

As a result, bpf_prog_get_ok() explicitly rejects any offloaded program
with -EINVAL before tcx_prog_attach() is ever called.

While the checks added to tcx_link_attach() and tcx_link_update() lower
in this patch appear necessary (since link creation uses bpf_prog_get(),
which skips attach-type validation and bypasses bpf_prog_get_ok()), does
the caller environment make this specific check in tcx_prog_attach()
unreachable?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260424104201.217604-1-jiayuan.chen@linux.dev?part=1