Re: [PATCH 2/3] io_uring: add support for BPF filtering for opcode restrictions

[Jonathan Corbet <corbet@lwn.net>]

Jens Axboe <axboe@kernel.dk> writes:

> On 1/15/26 1:11 PM, Jonathan Corbet wrote:
>> Jens Axboe <axboe@kernel.dk> writes:
>> 
>>> This adds support for loading BPF programs with io_uring, which can
>>> restrict the opcodes performed. Unlike IORING_REGISTER_RESTRICTIONS,
>>> using BPF programs allow fine grained control over both the opcode
>>> in question, as well as other data associated with the request.
>>> Initially only IORING_OP_SOCKET is supported.
>> 
>> A minor nit...
>> 
>> [...]
>> 
>>> +/*
>>> + * Run registered filters for a given opcode. Return of 0 means that the
>>> + * request should be allowed.
>>> + */
>>> +int __io_uring_run_bpf_filters(struct io_restriction *res, struct io_kiocb *req)
>>> +{
>> 
>> That comment seems to contradict the actual logic in this function, as
>> well as the example BPF program in the cover letter.  So
>> s/allowed/blocked/?
>
> Are you talking about __io_uring_run_bpf_filters() or the filters
> themselves? For the former, 0 does indeed mean "yep let it rip", for the
> filters it's 0/1 where 0 is deny and 1 is allow. I should probably make
> the comment more explicit on that front...

Ah, yes, I got confused between the two, sorry for the noise.

jon