Re: [PATCH net v2 2/3] net/sched: cls_bpf: accept dev-bound programs on shared blocks

[Simon Horman <horms@kernel.org>]

On Sat, Oct 10, 2026 at 05:02:49PM -0400, Jamal Hadi Salim wrote:
> The issue:
> Follow-up to commit 120977e2c096 ("net/sched: cls_bpf: reject dev-bound
> programs bound to a different device"), which derived the target device
> from block->q:
> 
> 	dev = block->q ? qdisc_dev(block->q) : NULL;
> 
> tcf_block_create() leaves block->q NULL for shared blocks, so a
> device-bound program attached through a shared block is rejected with
> -EINVAL even when it is bound to a netdev that owns the block.  The
> offload path (cls_bpf_offload_cmd()) never consults block->q and drives
> the per-device callbacks for shared blocks as before.
> 
> The Fix:
> Accept the attach on a shared block when bpf_offload_dev_match() matches
> every netdev bound to the block, and reject an empty block.  Every member
> must match because the offload path broadcasts the program to every
> callback registered on the block, so an any-member check would re-admit
> the wrong-device attach on a mixed block.  Every dev-bound SCHED_CLS
> attach is skip_sw, which becomes err_stop and aborts the offload on the
> first failing callback, so the all-members rule is the offload path's own
> semantics.
> 
> Iterate the public block->ports xarray (913b47d3424e, v6.8-rc1) rather
> than block->owner_list, which is private to cls_api.c.  The shared-block
> rejection reports "Program is not bound to every device in the block",
> distinct from the non-shared message, because a member can exist without
> a registered callback (netdevsim registers its block callback
> ingress-only).
> 
> Context note:
> This patch is not an independent fix: it re-exposes the shared-block
> replay path that commit 120977e2c096 ("net/sched: cls_bpf: reject
> dev-bound programs bound to a different device") had closed, so patch 1
> must be applied first, including in stable.  A stable tree taking this
> patch alone would re-enable shared-block attaches on a kernel whose
> netdevsim callback is still unchecked.
> 
> Conditions to recreate the bug:
>   - CONFIG_NETDEVSIM=y, CONFIG_NET_CLS_BPF=y
>   - load a dev-bound SCHED_CLS program for netdevsim device B
>     (prog_ifindex=B), pin it in bpffs
>   - tc qdisc add dev B ingress_block 22 clsact
>   - tc filter add block 22 ingress bpf da object-pinned <pin> skip_sw
>   Unfixed, the filter add fails with -EINVAL ("Program is bound to a
>   different device"); fixed, it succeeds.  Adding a second, independently
>   backed netdevsim device to the same block makes the attach fail again.
> 
> Fixes: 120977e2c096 ("net/sched: cls_bpf: reject dev-bound programs bound to a different device")
> Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/netdev/20260809094418.901607-1-jhs@mojatatu.com/
> Link: https://lore.kernel.org/netdev/QDISC-PYC7.v1.20261003103747@mojatatu.com/
> Cc: stable@vger.kernel.org
> Reviewed-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

Reviewed-by: Simon Horman <horms@kernel.org>