Re: [PATCH 2/3] io_uring: add support for BPF filtering for opcode restrictions

[Jens Axboe <axboe@kernel.dk>]

On 1/15/26 1:11 PM, Jonathan Corbet wrote:
> Jens Axboe <axboe@kernel.dk> writes:
> 
>> This adds support for loading BPF programs with io_uring, which can
>> restrict the opcodes performed. Unlike IORING_REGISTER_RESTRICTIONS,
>> using BPF programs allow fine grained control over both the opcode
>> in question, as well as other data associated with the request.
>> Initially only IORING_OP_SOCKET is supported.
> 
> A minor nit...
> 
> [...]
> 
>> +/*
>> + * Run registered filters for a given opcode. Return of 0 means that the
>> + * request should be allowed.
>> + */
>> +int __io_uring_run_bpf_filters(struct io_restriction *res, struct io_kiocb *req)
>> +{
> 
> That comment seems to contradict the actual logic in this function, as
> well as the example BPF program in the cover letter.  So
> s/allowed/blocked/?

Are you talking about __io_uring_run_bpf_filters() or the filters
themselves? For the former, 0 does indeed mean "yep let it rip", for the
filters it's 0/1 where 0 is deny and 1 is allow. I should probably make
the comment more explicit on that front...

-- 
Jens Axboe