From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: <bestswngs@gmail.com>, <daniel@iogearbox.net>,
<andrii@kernel.org>, <eddyz87@gmail.com>, <memxor@gmail.com>,
<bpf@vger.kernel.org>, <netdev@vger.kernel.org>
Cc: <martin.lau@linux.dev>, <song@kernel.org>,
<yonghong.song@linux.dev>, <jolsa@kernel.org>,
<emil@etsalapatis.com>, <ihor.solodrai@linux.dev>,
<davem@davemloft.net>, <kuba@kernel.org>, <hawk@kernel.org>,
<john.fastabend@gmail.com>, <sdf@fomichev.me>, <xmei5@asu.edu>,
<stable@vger.kernel.org>, <co+ac0a8c41de69121d@bugs.sh>
Subject: Re: [PATCH bpf] bpf: reject dev-bound-only programs on other devices
Date: Thu, 17 Sep 2026 17:01:06 +0000 [thread overview]
Message-ID: <DLHR3TXGGQQA.35NANUU0VNBB2@gmail.com> (raw)
In-Reply-To: <20260917161335.1020405-2-bestswngs@gmail.com>
On Fri, Sep 18, 2026 at 12:13 AM bestswngs@gmail.com <bestswngs@gmail.com> wrote:
> @@ -698,11 +698,14 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog,
> return false;
> if (offload->netdev == netdev)
> return true;
> + if (!bpf_prog_is_offloaded(prog->aux))
> + return false;
>
> ondev1 = bpf_offload_find_netdev(offload->netdev);
> ondev2 = bpf_offload_find_netdev(netdev);
>
> - return ondev1 && ondev2 && ondev1->offdev == ondev2->offdev;
> + return ondev1 && ondev2 && ondev1->offdev &&
> + ondev1->offdev == ondev2->offdev;
With the !bpf_prog_is_offloaded() check above only offloaded progs get
here, and __bpf_prog_dev_bound_init() already rejects those unless
ondev->offdev is set. ondev1->offdev cannot be NULL. Drop this hunk.
Also drop the "attacker" wording from the commit log.
It's CAP_BPF + CAP_NET_ADMIN.
pw-bot: cr
next prev parent reply other threads:[~2026-09-17 17:01 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 16:13 [PATCH bpf] bpf: reject dev-bound-only programs on other devices bestswngs
2026-09-17 17:01 ` Alexei Starovoitov [this message]
2026-09-17 17:32 ` Stanislav Fomichev
2026-09-19 11:01 ` Weiming Shi
2026-09-19 11:00 ` [PATCH bpf v2 1/2] " bestswngs
2026-09-19 11:00 ` [PATCH bpf v2 2/2] selftests: net: test cross-device XDP dev-bound attachment bestswngs
2026-09-19 11:03 ` [PATCH bpf v2 1/2] bpf: reject dev-bound-only programs on other devices Weiming Shi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLHR3TXGGQQA.35NANUU0VNBB2@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bestswngs@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=co+ac0a8c41de69121d@bugs.sh \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=hawk@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=stable@vger.kernel.org \
--cc=xmei5@asu.edu \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox