Re: [PATCH bpf v2 3/3] bpf, xdp: reject offloaded programs on link update

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Critical] Incomplete validation mirroring in `bpf_xdp_link_update()` allows device-bound programs to bypass security checks, leading to type confusion and memory corruption.
--

commit 32f74494cb77525b641fbd462cda3a2dfccc0147
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf, xdp: reject offloaded programs on link update

This commit mirrors the offload check from dev_xdp_attach to
bpf_xdp_link_update to reject offloaded programs when the link is not in
HW mode. This prevents a user from replacing a regular XDP link with an
offloaded program via BPF_LINK_UPDATE.

> diff --git a/net/core/dev.c b/net/core/dev.c
> --- a/net/core/dev.c
> +++ b/net/core/dev.c

[ ... ]

> @@ -10678,6 +10678,11 @@ static int bpf_xdp_link_update(struct bpf_link *link, struct bpf_prog *new_prog,
>  
>  	netdev_lock_ops(xdp_link->dev);
>  	mode = dev_xdp_mode(xdp_link->dev, xdp_link->flags);
> +	if (mode != XDP_MODE_HW && bpf_prog_is_offloaded(new_prog->aux)) {

Does this check omit the dev_bound validations that are already present in
dev_xdp_attach?

If a program is loaded with BPF_F_XDP_DEV_BOUND_ONLY, it has dev_bound set
to true but offload_requested set to false, meaning bpf_prog_is_offloaded
will return false. Could such a program bypass this check and be attached
to an SKB-mode link, potentially causing the generic XDP runner to execute
device-specific kfuncs that cast the generic xdp_md context to
driver-specific structures?

Additionally, if the link is in HW mode, this condition evaluates to false
and the validation is skipped. Does this allow a program offloaded to a
different device to be attached to an HW link on the current device? If so,
the driver might receive XDP_SETUP_PROG_HW and incorrectly cast the new
program's aux->offload->dev_priv to its own internal structure, resulting
in memory corruption.

> +		netdev_unlock_ops(xdp_link->dev);
> +		err = -EINVAL;
> +		goto out_unlock;
> +	}
>  	bpf_op = dev_xdp_bpf_op(xdp_link->dev, mode);
>  	err = dev_xdp_install(xdp_link->dev, mode, bpf_op, NULL,
>  			      xdp_link->flags, new_prog);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260424104201.217604-1-jiayuan.chen@linux.dev?part=3