From nobody Sun Apr 5 13:11:12 2026 Received: from out-174.mta1.migadu.com (out-174.mta1.migadu.com [95.215.58.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 251B44035BE for ; Tue, 24 Mar 2026 15:05:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774364737; cv=none; b=CK7dcnc+YbOfJaEQfLASjbdTf/uN4JmiopCkjCFVNt3QTiCNww4bUgmFPZiD4ksT2pjn7yFIaO0aCPYhsUol7i/PV+Qdoa4QX9D76Hofk2N357wXWgq6IDDUB7qD29xxXFJBjD80L24XhaiOukowEfHfImAmhl8fkbYOHHA7NYI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774364737; c=relaxed/simple; bh=1OUXSxliGxs2W5u+A/o5NRDqjqs0xKl/4cLd/mJKN9k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gAsk3EubPJXhcR4UHX2uvLdxikrXi8rDaXWsM9ioNU8VAE9YUul6HiUPKOgJO2PRAC5/bb2QeOjeaE11PXE471d7PSTnGN5QSGPpjBoFtB4oM86+y4uqcg/Kh8KMwdE0Q1zhKiu0xboFN6QDqMh2Nkrqfo1HREDWjFqCE6H55AE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=R7QRd39k; arc=none smtp.client-ip=95.215.58.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="R7QRd39k" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774364731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x8OYL681E9dxdDA5qL/B2G4Dr49rI/KGwvFW7ZoQDW0=; b=R7QRd39kfR8Cv3zgj1iUp2UQOeZb12NKDSqi5aodhoPat9lZEW1gtIRV4Qk5VEVGufz5u8 OouFM4dVUfzcO2aNerjBz3NT7r5gqcSuOPP+Bj8C4w64YhBx9Jn9wGR8bgIVwuLfe8XE0Z QSgqDuAb+UNXZEy/MBY+4j0ZOfkW1yw= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , "David S . Miller" , Jakub Kicinski , Jesper Dangaard Brouer , Leon Hwang , Toke Hoiland-Jorgensen , Lorenzo Bianconi , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next 1/3] bpf: Disallow freplace on XDP with mismatched xdp_has_frags values Date: Tue, 24 Mar 2026 23:04:42 +0800 Message-ID: <20260324150444.68166-2-leon.hwang@linux.dev> In-Reply-To: <20260324150444.68166-1-leon.hwang@linux.dev> References: <20260324150444.68166-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" xdp_has_frags was introduced by the commit c2f2cdbeffda ("bpf: introduce BPF_F_XDP_HAS_FRAGS flag in prog_flags loadin= g the ebpf program"). The commit f45d5b6ce2e8 ("bpf: generalise tail call map compatibility check= ") was to ensure backwards compatibility against tail calls. However, it missed that XDP progs can be extended by freplace progs, which could break the backwards compatibility, e.g. xdp_has_frags=3Dtrue freplace progs are allowed to attach to xdp_has_frags=3Dfalse XDP progs. To avoid breaking the backwards compatibility via freplace, disallow freplace on XDP programs with different xdp_has_frags values. Cc: Toke Hoiland-Jorgensen Cc: John Fastabend Cc: Lorenzo Bianconi Fixes: c2f2cdbeffda ("bpf: introduce BPF_F_XDP_HAS_FRAGS flag in prog_flags= loading the ebpf program") Signed-off-by: Leon Hwang --- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index cd008b146ee5..12330466d58b 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -25519,6 +25519,10 @@ static int check_attach_btf_id(struct bpf_verifier= _env *env) */ env->ops =3D bpf_verifier_ops[tgt_prog->type]; prog->expected_attach_type =3D tgt_prog->expected_attach_type; + if (prog->aux->xdp_has_frags !=3D tgt_prog->aux->xdp_has_frags) { + verbose(env, "Extension program cannot have different xdp_has_frags val= ue with target prog\n"); + return -EINVAL; + } } =20 /* store info about the attachment target that will be used later */ --=20 2.53.0