Re: [syzbot] [bpf?] general protection fault in bpf_prog_offload_verifier_prep

[Jakub Kicinski]

On Wed, 06 Sep 2023 16:50:23 +0300 Eduard Zingerman wrote:
> diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
> index 3e4f2ec1af06..302e38bffffa 100644
> --- a/kernel/bpf/offload.c
> +++ b/kernel/bpf/offload.c
> @@ -199,12 +199,11 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n
>         offload->netdev = netdev;
>  
>         ondev = bpf_offload_find_netdev(offload->netdev);
> +       if (bpf_prog_is_offloaded(prog->aux) && (!ondev || !ondev->offdev)) {
> +               err = -EINVAL;
> +               goto err_free;
> +       }
>         if (!ondev) {
> -               if (bpf_prog_is_offloaded(prog->aux)) {
> -                       err = -EINVAL;
> -                       goto err_free;
> -               }
> -
>                 /* When only binding to the device, explicitly
>                  * create an entry in the hashtable.
>                  */

LGTM, FWIW.

> With the following reasoning: for offloaded programs offload device
> should exist and it should not be a fake device create in !ondev branch.
> 
> Stanislav, could you please take a look? I think this is related to commit:
> 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")