[PATCH bpf-next v4 0/3] bpf: prevent offloaded programs from running on host via tcx/netkit

[PATCH bpf-next v4 0/3] bpf: prevent offloaded programs from running on host via tcx/netkit

[Jiayuan Chen]

Patch 1 fixes the reported bug [1]. Patch 2 fixes an old bug that was
already there. Patch 3 is a test that reproduces the bug in patch 2.

Patch 1 has no test here: the original report already has a reproducer,
and it needs netdevsim, which is not easy to do in a selftest.

An offloaded program runs on the NIC, so its bpf_func is set to
bpf_prog_warn_on_exec(). tcx, netkit and XDP run programs on the host, so
attaching an offloaded program to them hits the WARN on the first packet.
Patch 1 adds the check in bpf_mprog_attach(), the one place both tcx and
netkit go through. Patch 2 moves the XDP check into dev_xdp_install() so
the bpf_xdp_link_update() path is covered too.


[1]: https://lore.kernel.org/bpf/64d8e2b5-a214-4f3c-b9e8-bcedbcb2c602@hust.edu.cn/
 ------------[ cut here ]------------
 attempt to execute device eBPF program on the host!
 WARNING: kernel/bpf/offload.c:420 at 0x0, CPU#0: poc/337
 PKRU: 55555554
 Call Trace:
  <TASK>
  __dev_queue_xmit+0x22cb/0x3530
  ip_finish_output2+0x621/0x1a60
  ip_output+0x170/0x2e0
  ip_send_skb+0x129/0x180
  udp_send_skb+0x65d/0x1300
  udp_sendmsg+0x13bf/0x2000
  __sys_sendto+0x396/0x470
  __x64_sys_sendto+0xdc/0x1b0
  do_syscall_64+0x76/0x10a0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 ---[ end trace 0000000000000000 ]---

v3 -> v4:
  - patch 2: also move the two device-bound checks, not just the offload
    one, so the link update path can't skip them (from the AI review on v3).
  - add patch 3, a selftest for the link update path.
v3: https://lore.kernel.org/bpf/20260425105942.223757-1-jiayuan.chen@linux.dev/

v2 -> v3:
  - Alexei said to do the check in one place instead of spreading it
    across attach paths. Put it in bpf_mprog_attach() for tcx/netkit and
    move the XDP check into dev_xdp_install(). Three patches became two.
v2: https://lore.kernel.org/bpf/20260424104201.217604-1-jiayuan.chen@linux.dev/

v1 -> v2:
  - tcx/netkit: also reject offloaded progs in the link update callback,
    not just attach (from the AI review on v1).
  - add a patch for the same hole in bpf_xdp_link_update().
v1: https://lore.kernel.org/bpf/20260423033609.252464-1-jiayuan.chen@linux.dev/

Jiayuan Chen (3):
  bpf, tcx, netkit: reject offloaded programs
  bpf, xdp: move offload check into dev_xdp_install()
  selftests/bpf: xdp: test dev_xdp_install() rejects device-bound
    program

 kernel/bpf/mprog.c                            | 11 +++++
 net/core/dev.c                                | 27 +++++-----
 .../bpf/prog_tests/xdp_dev_bound_only.c       | 49 +++++++++++++++++++
 3 files changed, 75 insertions(+), 12 deletions(-)

-- 
2.43.0

[PATCH bpf-next v4 1/3] bpf, tcx, netkit: reject offloaded programs

[Jiayuan Chen]

An offloaded program runs on the NIC, so its bpf_func is set to
bpf_prog_warn_on_exec(). tcx and netkit run programs on the host with
bpf_prog_run(), so attaching an offloaded program to them hits the WARN
on the first packet.

Both tcx and netkit go through bpf_mprog_attach(), so add the check there
once instead of in every attach path. Only check SCHED_CLS programs, so a
future mprog user that wants offloaded programs still works.

Fixes: 053c8e1f235dc ("bpf: Add generic attach/detach/query API for multi-progs")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Closes: https://lore.kernel.org/bpf/64d8e2b5-a214-4f3c-b9e8-bcedbcb2c602@hust.edu.cn/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 kernel/bpf/mprog.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/bpf/mprog.c b/kernel/bpf/mprog.c
index 1394168062e8..0b50464ec902 100644
--- a/kernel/bpf/mprog.c
+++ b/kernel/bpf/mprog.c
@@ -222,6 +222,14 @@ static int bpf_mprog_pos_after(struct bpf_mprog_entry *entry,
 	return tuple->prog ? -ENOENT : bpf_mprog_total(entry);
 }
 
+static int bpf_mprog_check_prog(const struct bpf_prog *prog)
+{
+	if (prog->type == BPF_PROG_TYPE_SCHED_CLS &&
+	    bpf_prog_is_offloaded(prog->aux))
+		return -EINVAL;
+	return 0;
+}
+
 int bpf_mprog_attach(struct bpf_mprog_entry *entry,
 		     struct bpf_mprog_entry **entry_new,
 		     struct bpf_prog *prog_new, struct bpf_link *link,
@@ -237,6 +245,9 @@ int bpf_mprog_attach(struct bpf_mprog_entry *entry,
 	};
 	int ret, idx = -ERANGE, tidx;
 
+	ret = bpf_mprog_check_prog(prog_new);
+	if (ret)
+		return ret;
 	if (revision && revision != bpf_mprog_revision(entry))
 		return -ESTALE;
 	if (bpf_mprog_exists(entry, prog_new))
-- 
2.43.0

[PATCH bpf-next v4 2/3] bpf, xdp: move offload check into dev_xdp_install()

[Jiayuan Chen]

bpf_xdp_link_update() calls dev_xdp_install() directly and skips
dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can
make an XDP link with a normal program and then swap in an offloaded or
device-bound program with BPF_LINK_UPDATE, which puts it on the software
path.

Move the three program checks (offloaded, bound to another device, and
device-bound in generic mode) from dev_xdp_attach() into
dev_xdp_install(), so both the attach path and the link update path are
covered.

Fixes: 026a4c28e1db3 ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/core/dev.c | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index af260ff5462a..3281f226c1e5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10329,6 +10329,21 @@ static int dev_xdp_install(struct net_device *dev, enum bpf_xdp_mode mode,
 
 	netdev_assert_locked_ops_compat(dev);
 
+	if (prog) {
+		if (mode != XDP_MODE_HW && bpf_prog_is_offloaded(prog->aux)) {
+			NL_SET_ERR_MSG(extack, "Using offloaded program without HW_MODE flag is not supported");
+			return -EINVAL;
+		}
+		if (bpf_prog_is_dev_bound(prog->aux) && !bpf_offload_dev_match(prog, dev)) {
+			NL_SET_ERR_MSG(extack, "Program bound to different device");
+			return -EINVAL;
+		}
+		if (bpf_prog_is_dev_bound(prog->aux) && mode == XDP_MODE_SKB) {
+			NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode");
+			return -EINVAL;
+		}
+	}
+
 	if (dev->cfg->hds_config == ETHTOOL_TCP_DATA_SPLIT_ENABLED &&
 	    prog && !prog->aux->xdp_has_frags) {
 		NL_SET_ERR_MSG(extack, "unable to install XDP to device using tcp-data-split");
@@ -10480,18 +10495,6 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
 			NL_SET_ERR_MSG(extack, "Native and generic XDP can't be active at the same time");
 			return -EEXIST;
 		}
-		if (!offload && bpf_prog_is_offloaded(new_prog->aux)) {
-			NL_SET_ERR_MSG(extack, "Using offloaded program without HW_MODE flag is not supported");
-			return -EINVAL;
-		}
-		if (bpf_prog_is_dev_bound(new_prog->aux) && !bpf_offload_dev_match(new_prog, dev)) {
-			NL_SET_ERR_MSG(extack, "Program bound to different device");
-			return -EINVAL;
-		}
-		if (bpf_prog_is_dev_bound(new_prog->aux) && mode == XDP_MODE_SKB) {
-			NL_SET_ERR_MSG(extack, "Can't attach device-bound programs in generic mode");
-			return -EINVAL;
-		}
 		if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) {
 			NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not be attached to a device");
 			return -EINVAL;
-- 
2.43.0

[PATCH bpf-next v4 3/3] selftests/bpf: xdp: test dev_xdp_install() rejects device-bound program

[Jiayuan Chen]

bpf_xdp_link_update() used to skip the checks in dev_xdp_attach(). Add a
test that makes a generic XDP link with a normal program and then tries
to swap in a device-bound program, which must fail.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 .../bpf/prog_tests/xdp_dev_bound_only.c       | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c b/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
index 7dd18c6d06c6..4a13f8ec4300 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
@@ -1,9 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <net/if.h>
+#include <linux/if_link.h>
 #include <test_progs.h>
 #include <network_helpers.h>
 
 #define LOCAL_NETNS "xdp_dev_bound_only_netns"
+#define LINK_UPDATE_NETNS "xdp_dev_bound_only_lu_netns"
 
 static int load_dummy_prog(char *name, __u32 ifindex, __u32 flags)
 {
@@ -59,3 +61,50 @@ void test_xdp_dev_bound_only_offdev(void)
 	 */
 	SYS_NOFAIL("ip netns del " LOCAL_NETNS);
 }
+
+/* A device-bound program must not run on the XDP software path.
+ * dev_xdp_attach() rejected such programs, but bpf_xdp_link_update() reaches
+ * dev_xdp_install() directly and bypasses it, so the check has to live in
+ * dev_xdp_install(). Create a generic (SKB) XDP link with a normal program,
+ * then try to swap in a device-bound program via BPF_LINK_UPDATE.
+ */
+void test_xdp_dev_bound_only_link_update(void)
+{
+	LIBBPF_OPTS(bpf_link_create_opts, lopts, .flags = XDP_FLAGS_SKB_MODE);
+	int base_fd = -1, devbound_fd = -1, link_fd = -1;
+	struct nstoken *tok = NULL;
+	__u32 ifindex;
+	int err;
+
+	SYS(out, "ip netns add " LINK_UPDATE_NETNS);
+	tok = open_netns(LINK_UPDATE_NETNS);
+	if (!ASSERT_OK_PTR(tok, "open_netns"))
+		goto out;
+
+	SYS(out, "ip link add eth42 type veth");
+	ifindex = if_nametoindex("eth42");
+	if (!ASSERT_NEQ(ifindex, 0, "if_nametoindex"))
+		goto out;
+
+	devbound_fd = load_dummy_prog("devbound", ifindex, BPF_F_XDP_DEV_BOUND_ONLY);
+	if (!ASSERT_GE(devbound_fd, 0, "load_dummy_prog devbound"))
+		goto out;
+
+	base_fd = load_dummy_prog("base", 0, 0);
+	if (!ASSERT_GE(base_fd, 0, "load_dummy_prog base"))
+		goto out;
+
+	link_fd = bpf_link_create(base_fd, ifindex, BPF_XDP, &lopts);
+	if (!ASSERT_GE(link_fd, 0, "bpf_link_create"))
+		goto out;
+
+	err = bpf_link_update(link_fd, devbound_fd, NULL);
+	ASSERT_EQ(err, -EINVAL, "link_update device-bound rejected");
+
+out:
+	close(link_fd);
+	close(base_fd);
+	close(devbound_fd);
+	close_netns(tok);
+	SYS_NOFAIL("ip netns del " LINK_UPDATE_NETNS);
+}
-- 
2.43.0

Re: [PATCH bpf-next v4 3/3] selftests/bpf: xdp: test dev_xdp_install() rejects device-bound program

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 4050 bytes --]

> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c b/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
> index 7dd18c6d06c6..4a13f8ec4300 100644
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_dev_bound_only.c
> @@ -1,9 +1,11 @@
>  // SPDX-License-Identifier: GPL-2.0
>  #include <net/if.h>
> +#include <linux/if_link.h>
>  #include <test_progs.h>
>  #include <network_helpers.h>
>
>  #define LOCAL_NETNS "xdp_dev_bound_only_netns"
> +#define LINK_UPDATE_NETNS "xdp_dev_bound_only_lu_netns"
>
>  static int load_dummy_prog(char *name, __u32 ifindex, __u32 flags)
>  {
> @@ -59,3 +61,50 @@ void test_xdp_dev_bound_only_offdev(void)
>  	 */
>  	SYS_NOFAIL("ip netns del " LOCAL_NETNS);
>  }
> +
> +/* A device-bound program must not run on the XDP software path.
> + * dev_xdp_attach() rejected such programs, but bpf_xdp_link_update() reaches
> + * dev_xdp_install() directly and bypasses it, so the check has to live in
> + * dev_xdp_install(). Create a generic (SKB) XDP link with a normal program,
> + * then try to swap in a device-bound program via BPF_LINK_UPDATE.
> + */
> +void test_xdp_dev_bound_only_link_update(void)
> +{
> +	LIBBPF_OPTS(bpf_link_create_opts, lopts, .flags = XDP_FLAGS_SKB_MODE);
> +	int base_fd = -1, devbound_fd = -1, link_fd = -1;
> +	struct nstoken *tok = NULL;
> +	__u32 ifindex;
> +	int err;
> +
> +	SYS(out, "ip netns add " LINK_UPDATE_NETNS);
> +	tok = open_netns(LINK_UPDATE_NETNS);
> +	if (!ASSERT_OK_PTR(tok, "open_netns"))
> +		goto out;
> +
> +	SYS(out, "ip link add eth42 type veth");

A subsystem pattern flags this as potentially concerning: the new test
hand-rolls the network-namespace lifecycle with SYS("ip netns add") plus
open_netns() here and close_netns()/SYS_NOFAIL("ip netns del") at the
teardown, but the BPF selftest framework already provides this as a
single pair netns_new(name, true) and netns_free(netns), declared at
tools/testing/selftests/bpf/test_progs.h and implemented at
tools/testing/selftests/bpf/test_progs.c.

The shared version additionally brings lo up and wires up traffic-monitor
start/stop for -m runs, neither of which the hand-rolled sequence does.
Both LINK_UPDATE_NETNS and the paired add/del strings are also duplicated
state that netns_new() would own.

The new function is a deliberate copy of the sibling
test_xdp_dev_bound_only_offdev() at lines 27-63 of the same file, which
uses exactly the same SYS/open_netns/close_netns/SYS_NOFAIL sequence,
and 28 other files under prog_tests/ create namespaces the same way
rather than via netns_new(). Keeping the two functions in one file
structurally symmetric has clear readability value.

The functional deltas (lo not brought up, no traffic monitor) do not
affect this test, which never sends traffic. Would you prefer
netns_new()/netns_free() here for consistency with the framework helpers,
or is the structural symmetry with the sibling function the better choice?

> +	ifindex = if_nametoindex("eth42");
> +	if (!ASSERT_NEQ(ifindex, 0, "if_nametoindex"))
> +		goto out;
> +
> +	devbound_fd = load_dummy_prog("devbound", ifindex, BPF_F_XDP_DEV_BOUND_ONLY);
> +	if (!ASSERT_GE(devbound_fd, 0, "load_dummy_prog devbound"))
> +		goto out;
> +
> +	base_fd = load_dummy_prog("base", 0, 0);
> +	if (!ASSERT_GE(base_fd, 0, "load_dummy_prog base"))
> +		goto out;
> +
> +	link_fd = bpf_link_create(base_fd, ifindex, BPF_XDP, &lopts);
> +	if (!ASSERT_GE(link_fd, 0, "bpf_link_create"))
> +		goto out;
> +
> +	err = bpf_link_update(link_fd, devbound_fd, NULL);
> +	ASSERT_EQ(err, -EINVAL, "link_update device-bound rejected");
> +
> +out:
> +	close(link_fd);
> +	close(base_fd);
> +	close(devbound_fd);
> +	close_netns(tok);
> +	SYS_NOFAIL("ip netns del " LINK_UPDATE_NETNS);
> +}

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31358779411