CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsbpf: prevent unbounded recursion in offload rollback

Quan Sun reported [1] a stack overflow in clsbpfoffloadcmd().

Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filter replace. The replace calls tcsetupcbreplace() which fails. clsbpfoffloadcmd() then swaps prog/oldprog and recursively calls itself to roll back. But bpftcaccept=0 makes the rollback fail too, which triggers yet another rollback frame with the same arguments, and so on until the stack is exhausted.

bpftcaccept is just a convenient knob for the reproducer. Any driver whose tcsetupcbreplace() fails twice in a row can hit the same loop, so this is not a netdevsim-only issue.

Two ways to fix it:

1) Have the rollback call tcsetupcbadd() on oldprog instead of re-entering clsbpfoffloadcmd(). 2) Mark the rollback frame with a flag and skip a second-level rollback from inside it.

Go with (2). It is the smaller change and keeps the original behaviour: the rollback still goes through tcsetupcbreplace(), so the driver gets one real chance to restore its state. If that attempt also fails, we just return the original error instead of recursing.

[1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u