* Re: [PATCH bpf] bpf: reject dev-bound-only programs on other devices
2026-09-17 16:13 [PATCH bpf] bpf: reject dev-bound-only programs on other devices bestswngs
@ 2026-09-17 17:01 ` Alexei Starovoitov
2026-09-17 17:32 ` Stanislav Fomichev
2026-09-19 11:00 ` [PATCH bpf v2 1/2] " bestswngs
2 siblings, 0 replies; 7+ messages in thread
From: Alexei Starovoitov @ 2026-09-17 17:01 UTC (permalink / raw)
To: bestswngs, daniel, andrii, eddyz87, memxor, bpf, netdev
Cc: martin.lau, song, yonghong.song, jolsa, emil, ihor.solodrai,
davem, kuba, hawk, john.fastabend, sdf, xmei5, stable,
co+ac0a8c41de69121d
On Fri, Sep 18, 2026 at 12:13 AM bestswngs@gmail.com <bestswngs@gmail.com> wrote:
> @@ -698,11 +698,14 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
> return false;
> if (offload->netdev == netdev)
> return true;
> + if (!bpf_prog_is_offloaded(prog->aux))
> + return false;
>
> ondev1 = bpf_offload_find_netdev(offload->netdev);
> ondev2 = bpf_offload_find_netdev(netdev);
>
> - return ondev1 && ondev2 && ondev1->offdev == ondev2->offdev;
> + return ondev1 && ondev2 && ondev1->offdev &&
> + ondev1->offdev == ondev2->offdev;
With the !bpf_prog_is_offloaded() check above only offloaded progs get
here, and __bpf_prog_dev_bound_init() already rejects those unless
ondev->offdev is set. ondev1->offdev cannot be NULL. Drop this hunk.
Also drop the "attacker" wording from the commit log.
It's CAP_BPF + CAP_NET_ADMIN.
pw-bot: cr
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH bpf] bpf: reject dev-bound-only programs on other devices
2026-09-17 16:13 [PATCH bpf] bpf: reject dev-bound-only programs on other devices bestswngs
2026-09-17 17:01 ` Alexei Starovoitov
@ 2026-09-17 17:32 ` Stanislav Fomichev
2026-09-19 11:01 ` Weiming Shi
2026-09-19 11:00 ` [PATCH bpf v2 1/2] " bestswngs
2 siblings, 1 reply; 7+ messages in thread
From: Stanislav Fomichev @ 2026-09-17 17:32 UTC (permalink / raw)
To: bestswngs
Cc: ast, daniel, andrii, eddyz87, memxor, bpf, netdev, martin.lau,
song, yonghong.song, jolsa, emil, ihor.solodrai, davem, kuba,
hawk, john.fastabend, sdf, xmei5, stable, co+ac0a8c41de69121d
On 09/18, bestswngs@gmail.com wrote:
> From: Weiming Shi <bestswngs@gmail.com>
>
> __bpf_offload_dev_match() falls back to comparing offdev pointers after an
> exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
> unrelated netdevs compare equal; one loaded on an offload-registered netdev
> can instead inherit a real offdev and match a sibling port. An attacker
> can use bpf(BPF_LINK_CREATE) with a different target ifindex to run
> metadata kfuncs specialized for the bound driver on the target driver's
> xdp_buff. Running a veth-bound program on tun reads beyond tun's bare
> stack xdp_buff as a veth_xdp_buff.
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
> Call Trace:
> ...
> tun_build_skb (drivers/net/tun.c:1739)
> tun_get_user (drivers/net/tun.c:1856)
> tun_chr_write_iter (drivers/net/tun.c:2091)
> vfs_write (fs/read_write.c:595 fs/read_write.c:687)
> ksys_write (fs/read_write.c:739)
> do_syscall_64 (arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Restrict non-offloaded programs to exact netdev matches and retain the
> shared-offdev fallback only for genuinely offloaded multi-port programs.
Any chance you can also add a testcase for this under
tools/testing/selftests/net/bpf_offload.py?
> Cc: stable@vger.kernel.org
> Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
> Reported-by: <co+ac0a8c41de69121d@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> kernel/bpf/offload.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
> index 0d6f55695..8c91d00d4 100644
> --- a/kernel/bpf/offload.c
> +++ b/kernel/bpf/offload.c
> @@ -698,11 +698,14 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
> return false;
> if (offload->netdev == netdev)
> return true;
> + if (!bpf_prog_is_offloaded(prog->aux))
> + return false;
>
> ondev1 = bpf_offload_find_netdev(offload->netdev);
> ondev2 = bpf_offload_find_netdev(netdev);
[..]
> - return ondev1 && ondev2 && ondev1->offdev == ondev2->offdev;
> + return ondev1 && ondev2 && ondev1->offdev &&
> + ondev1->offdev == ondev2->offdev;
> }
>
> bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev)
Why also have a null check here? Why doing !bpf_prog_is_offloaded above is not
enough?
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH bpf] bpf: reject dev-bound-only programs on other devices
2026-09-17 17:32 ` Stanislav Fomichev
@ 2026-09-19 11:01 ` Weiming Shi
0 siblings, 0 replies; 7+ messages in thread
From: Weiming Shi @ 2026-09-19 11:01 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: ast, daniel, andrii, eddyz87, memxor, bpf, netdev, martin.lau,
song, yonghong.song, jolsa, emil, ihor.solodrai, davem, kuba,
hawk, john.fastabend, sdf, xmei5, stable, co+ac0a8c41de69121d
Stanislav Fomichev <sdf.kernel@gmail.com> 于2026年9月18日周五 01:32写道：
>
> On 09/18, bestswngs@gmail.com wrote:
> > From: Weiming Shi <bestswngs@gmail.com>
> >
> > __bpf_offload_dev_match() falls back to comparing offdev pointers after an
> > exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
> > unrelated netdevs compare equal; one loaded on an offload-registered netdev
> > can instead inherit a real offdev and match a sibling port. An attacker
> > can use bpf(BPF_LINK_CREATE) with a different target ifindex to run
> > metadata kfuncs specialized for the bound driver on the target driver's
> > xdp_buff. Running a veth-bound program on tun reads beyond tun's bare
> > stack xdp_buff as a veth_xdp_buff.
> >
> > Oops: general protection fault, probably for non-canonical address
> > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> > RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
> > Call Trace:
> > ...
> > tun_build_skb (drivers/net/tun.c:1739)
> > tun_get_user (drivers/net/tun.c:1856)
> > tun_chr_write_iter (drivers/net/tun.c:2091)
> > vfs_write (fs/read_write.c:595 fs/read_write.c:687)
> > ksys_write (fs/read_write.c:739)
> > do_syscall_64 (arch/x86/entry/syscall_64.c:84)
> > entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> > Kernel panic - not syncing: Fatal exception in interrupt
> >
> > Restrict non-offloaded programs to exact netdev matches and retain the
> > shared-offdev fallback only for genuinely offloaded multi-port programs.
>
> Any chance you can also add a testcase for this under
> tools/testing/selftests/net/bpf_offload.py?
>
> > Cc: stable@vger.kernel.org
> > Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
> > Reported-by: <co+ac0a8c41de69121d@bugs.sh>
> > Assisted-by: LLM
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > ---
> > kernel/bpf/offload.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
> > index 0d6f55695..8c91d00d4 100644
> > --- a/kernel/bpf/offload.c
> > +++ b/kernel/bpf/offload.c
> > @@ -698,11 +698,14 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
> > return false;
> > if (offload->netdev == netdev)
> > return true;
> > + if (!bpf_prog_is_offloaded(prog->aux))
> > + return false;
> >
> > ondev1 = bpf_offload_find_netdev(offload->netdev);
> > ondev2 = bpf_offload_find_netdev(netdev);
>
> [..]
>
> > - return ondev1 && ondev2 && ondev1->offdev == ondev2->offdev;
> > + return ondev1 && ondev2 && ondev1->offdev &&
> > + ondev1->offdev == ondev2->offdev;
> > }
> >
> > bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev)
>
> Why also have a null check here? Why doing !bpf_prog_is_offloaded above is not
> enough?
Hi,
v2 and self test sent. Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH bpf v2 1/2] bpf: reject dev-bound-only programs on other devices
2026-09-17 16:13 [PATCH bpf] bpf: reject dev-bound-only programs on other devices bestswngs
2026-09-17 17:01 ` Alexei Starovoitov
2026-09-17 17:32 ` Stanislav Fomichev
@ 2026-09-19 11:00 ` bestswngs
2026-09-19 11:00 ` [PATCH bpf v2 2/2] selftests: net: test cross-device XDP dev-bound attachment bestswngs
2026-09-19 11:03 ` [PATCH bpf v2 1/2] bpf: reject dev-bound-only programs on other devices Weiming Shi
2 siblings, 2 replies; 7+ messages in thread
From: bestswngs @ 2026-09-19 11:00 UTC (permalink / raw)
To: ast, daniel, andrii, eddyz87, memxor, bpf, netdev
Cc: martin.lau, song, yonghong.song, jolsa, emil, ihor.solodrai,
davem, kuba, hawk, john.fastabend, sdf, xmei5,
co+ac0a8c41de69121d, Weiming Shi, stable
From: Weiming Shi <bestswngs@gmail.com>
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
Call Trace:
...
tun_build_skb (drivers/net/tun.c:1739)
tun_get_user (drivers/net/tun.c:1856)
tun_chr_write_iter (drivers/net/tun.c:2091)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.
Cc: stable@vger.kernel.org
Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
Reported-by: <co+ac0a8c41de69121d@bugs.sh>
Link: https://lore.kernel.org/bpf/20260917161335.1020405-2-bestswngs@gmail.com/
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
Changes in v2:
- Drop the redundant offdev NULL check.
- State the capability requirements instead of using attacker wording.
- Move the regression test to patch 2.
kernel/bpf/offload.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 0d6f55695..d85539981 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -698,6 +698,8 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
return false;
if (offload->netdev == netdev)
return true;
+ if (!bpf_prog_is_offloaded(prog->aux))
+ return false;
ondev1 = bpf_offload_find_netdev(offload->netdev);
ondev2 = bpf_offload_find_netdev(netdev);
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH bpf v2 2/2] selftests: net: test cross-device XDP dev-bound attachment
2026-09-19 11:00 ` [PATCH bpf v2 1/2] " bestswngs
@ 2026-09-19 11:00 ` bestswngs
2026-09-19 11:03 ` [PATCH bpf v2 1/2] bpf: reject dev-bound-only programs on other devices Weiming Shi
1 sibling, 0 replies; 7+ messages in thread
From: bestswngs @ 2026-09-19 11:00 UTC (permalink / raw)
To: ast, daniel, andrii, eddyz87, memxor, bpf, netdev
Cc: martin.lau, song, yonghong.song, jolsa, emil, ihor.solodrai,
davem, kuba, hawk, john.fastabend, sdf, xmei5,
co+ac0a8c41de69121d, Weiming Shi
From: Weiming Shi <bestswngs@gmail.com>
Add a regression test which loads dev-bound-only XDP programs on both ends
of a veth pair. Verify that attaching one program to the other device is
rejected with the expected extack.
The second program keeps a bound-only registration for the target device,
recreating the NULL-offdev collision fixed by the previous patch.
Link: https://lore.kernel.org/bpf/20260917161335.1020405-2-bestswngs@gmail.com/
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
Changes in v2:
- New patch.
tools/testing/selftests/net/bpf_offload.py | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/tools/testing/selftests/net/bpf_offload.py b/tools/testing/selftests/net/bpf_offload.py
index c856d266c..017910b4d 100755
--- a/tools/testing/selftests/net/bpf_offload.py
+++ b/tools/testing/selftests/net/bpf_offload.py
@@ -995,6 +995,24 @@ try:
rm("/sys/fs/bpf/devbound")
sim.wait_for_flush()
+ start_test("Test dev-bound program on a different device...")
+ cmd("ip link add bpfveth0 type veth peer name bpfveth1")
+ try:
+ bpftool_prog_load("sample_ret0.bpf.o", "/sys/fs/bpf/devbound0",
+ dev_bind="bpfveth0")
+ bpftool_prog_load("sample_ret0.bpf.o", "/sys/fs/bpf/devbound1",
+ dev_bind="bpfveth1")
+ ret, _, err = ip("link set dev bpfveth1 xdpdrv " +
+ bpf_pinned("/sys/fs/bpf/devbound0"), fail=False,
+ include_stderr=True)
+ fail(ret == 0, "dev-bound program attached to a different device")
+ check_extack(err, "Program bound to different device.", args)
+ finally:
+ cmd("ip link del bpfveth0", fail=False)
+ rm("/sys/fs/bpf/devbound0")
+ rm("/sys/fs/bpf/devbound1")
+ bpftool_prog_list_wait(expected=0)
+
start_test("Test XDP load failure...")
sim.dfs["dev/bpf_bind_verifier_accept"] = 0
ret, _, err = bpftool_prog_load("sample_ret0.bpf.o", "/sys/fs/bpf/offload",
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH bpf v2 1/2] bpf: reject dev-bound-only programs on other devices
2026-09-19 11:00 ` [PATCH bpf v2 1/2] " bestswngs
2026-09-19 11:00 ` [PATCH bpf v2 2/2] selftests: net: test cross-device XDP dev-bound attachment bestswngs
@ 2026-09-19 11:03 ` Weiming Shi
1 sibling, 0 replies; 7+ messages in thread
From: Weiming Shi @ 2026-09-19 11:03 UTC (permalink / raw)
To: ast, daniel, andrii, eddyz87, memxor, bpf, netdev
Cc: martin.lau, song, yonghong.song, jolsa, emil, ihor.solodrai,
davem, kuba, hawk, john.fastabend, sdf, xmei5,
co+ac0a8c41de69121d, stable
<bestswngs@gmail.com> 于2026年9月19日周六 19:01写道：
>
> From: Weiming Shi <bestswngs@gmail.com>
>
> __bpf_offload_dev_match() falls back to comparing offdev pointers after an
> exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
> unrelated netdevs compare equal. A bound-only program on an
> offload-registered netdev can instead inherit a real offdev and match a
> sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
> bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
> specialized for the bound driver on the target driver's xdp_buff. Running a
> veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
> veth_xdp_buff.
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
> Call Trace:
> ...
> tun_build_skb (drivers/net/tun.c:1739)
> tun_get_user (drivers/net/tun.c:1856)
> tun_chr_write_iter (drivers/net/tun.c:2091)
> vfs_write (fs/read_write.c:595 fs/read_write.c:687)
> ksys_write (fs/read_write.c:739)
> do_syscall_64 (arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> Kernel panic - not syncing: Fatal exception in interrupt
>
> Restrict non-offloaded programs to exact netdev matches and retain the
> shared-offdev fallback only for genuinely offloaded multi-port programs.
>
> Cc: stable@vger.kernel.org
> Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
> Reported-by: <co+ac0a8c41de69121d@bugs.sh>
> Link: https://lore.kernel.org/bpf/20260917161335.1020405-2-bestswngs@gmail.com/
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> Changes in v2:
> - Drop the redundant offdev NULL check.
> - State the capability requirements instead of using attacker wording.
> - Move the regression test to patch 2.
>
> kernel/bpf/offload.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
> index 0d6f55695..d85539981 100644
> --- a/kernel/bpf/offload.c
> +++ b/kernel/bpf/offload.c
> @@ -698,6 +698,8 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
> return false;
> if (offload->netdev == netdev)
> return true;
> + if (!bpf_prog_is_offloaded(prog->aux))
> + return false;
>
> ondev1 = bpf_offload_find_netdev(offload->netdev);
> ondev2 = bpf_offload_find_netdev(netdev);
> --
> 2.55.0
Sorry for the noise.
I mistakenly sent this v2 series as a reply to the v1 thread. Please
disregard this posting. I will resend v2 as a new two-patch series.
Apologies for the confusion.
^ permalink raw reply [flat|nested] 7+ messages in thread