Re: [PATCH net-next 1/3] bpf: Refactor cgroups code in prep for new type

[Daniel Borkmann]

On 10/26/2016 12:30 AM, David Ahern wrote:

Code move only; no functional change intended.

Not quite, see below.

Signed-off-by: David Ahern <d...@cumulusnetworks.com>
---
  kernel/bpf/cgroup.c  | 27 ++++++++++++++++++++++-----
  kernel/bpf/syscall.c | 28 +++++++++++++++-------------
  2 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index a0ab43f264b0..918c01a6f129 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -117,6 +117,19 @@ void __cgroup_bpf_update(struct cgroup *cgrp,
        }
  }

+static int __cgroup_bpf_run_filter_skb(struct sk_buff *skb,
+                                      struct bpf_prog *prog)
+{
+       unsigned int offset = skb->data - skb_network_header(skb);
+       int ret;
+
+       __skb_push(skb, offset);
+       ret = bpf_prog_run_clear_cb(prog, skb) == 1 ? 0 : -EPERM;

Original code save skb->cb[], this one clears it.

+       __skb_pull(skb, offset);
+
+       return ret;
+}
+
  /**
   * __cgroup_bpf_run_filter() - Run a program for packet filtering
   * @sk: The socken sending or receiving traffic
@@ -153,11 +166,15 @@ int __cgroup_bpf_run_filter(struct sock *sk,

        prog = rcu_dereference(cgrp->bpf.effective[type]);
        if (prog) {
-               unsigned int offset = skb->data - skb_network_header(skb);
-
-               __skb_push(skb, offset);
-               ret = bpf_prog_run_save_cb(prog, skb) == 1 ? 0 : -EPERM;
-               __skb_pull(skb, offset);
+               switch (type) {
+               case BPF_CGROUP_INET_INGRESS:
+               case BPF_CGROUP_INET_EGRESS:
+                       ret = __cgroup_bpf_run_filter_skb(skb, prog);
+                       break;
+               /* make gcc happy else complains about missing enum value */
+               default:
+                       return 0;
+               }
        }