[PATCH bpf-next v4 1/3] bpf, tcx, netkit: reject offloaded programs
From: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: 2026-08-10 05:07:31
Also in:
bpf, linux-kselftest, lkml
Subsystem:
bpf [core], bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
An offloaded program runs on the NIC, so its bpf_func is set to
bpf_prog_warn_on_exec(). tcx and netkit run programs on the host with
bpf_prog_run(), so attaching an offloaded program to them hits the WARN
on the first packet.
Both tcx and netkit go through bpf_mprog_attach(), so add the check there
once instead of in every attach path. Only check SCHED_CLS programs, so a
future mprog user that wants offloaded programs still works.
Fixes: 053c8e1f235dc ("bpf: Add generic attach/detach/query API for multi-progs")
Reported-by: Yinhao Hu <redacted>
Reported-by: Kaiyan Mei <redacted>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Closes: https://lore.kernel.org/bpf/64d8e2b5-a214-4f3c-b9e8-bcedbcb2c602@hust.edu.cn/ (local)
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
kernel/bpf/mprog.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/kernel/bpf/mprog.c b/kernel/bpf/mprog.c
index 1394168062e8..0b50464ec902 100644
--- a/kernel/bpf/mprog.c
+++ b/kernel/bpf/mprog.c@@ -222,6 +222,14 @@ static int bpf_mprog_pos_after(struct bpf_mprog_entry *entry, return tuple->prog ? -ENOENT : bpf_mprog_total(entry); } +static int bpf_mprog_check_prog(const struct bpf_prog *prog) +{ + if (prog->type == BPF_PROG_TYPE_SCHED_CLS && + bpf_prog_is_offloaded(prog->aux)) + return -EINVAL; + return 0; +} + int bpf_mprog_attach(struct bpf_mprog_entry *entry, struct bpf_mprog_entry **entry_new, struct bpf_prog *prog_new, struct bpf_link *link,
@@ -237,6 +245,9 @@ int bpf_mprog_attach(struct bpf_mprog_entry *entry, }; int ret, idx = -ERANGE, tidx; + ret = bpf_mprog_check_prog(prog_new); + if (ret) + return ret; if (revision && revision != bpf_mprog_revision(entry)) return -ESTALE; if (bpf_mprog_exists(entry, prog_new))
--
2.43.0