bpf, cgroup: fix cgroup struct_ops query for a second attach type
PATCH v2 1/1 bpf, cgroup: fix cgroup struct_ops query for a second attach type
Two things in __cgroup_bpf_query() work only because CGROUP_TCP_SOCK_OPS is the only struct_ops attach type.
It calls cgroup_bpf_enabled(atype) with an atype that find_atype_by_struct_ops_id() works out at runtime. That macro is an asm goto and needs a constant. Today the compiler can see there is only one value; add a second type and the build breaks with "impossible constraint in 'asm'". The check is not needed anyway. When the key is off nothing is attached, so progs[atype] and effective[atype] are empty and the count loop leaves total_cnt at 0. The other attach types already use that loop with no such check. Drop the check and the skip_count label.
And find_atype_by_struct_ops_id() matches on type_id alone. An attach type whose subsystem is not built keeps type_id 0, so a query for type 0 finds it and returns success with nothing instead of -ENOENT. Skip such slots.
---
v2:
- Drop the cgroup_bpf_enabled() check and the skip_count label instead of adding cgroup_bpf_enabled_runtime() (Alexei).
- Add the bpf-next subject prefix (Amery).
v1: https://lore.kernel.org/all/[email protected]/
kernel/bpf/cgroup.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
kernel/bpf/cgroup.c +1 -3
@@ -45,6 +45,7 @@ static enum cgroup_bpf_attach_type find_atype_by_struct_ops_id(u32 type_id)for (atype =0 ; atype <MAX_CGROUP_BPF_ATTACH_TYPE ; atype++) {if (cgroup_bpf_is_struct_ops_atype (atype) && + cgroup_struct_ops[atype].type_id && cgroup_struct_ops[atype].type_id == type_id)return atype; }
@@ -1448,8 +1449,6 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr,return -ENOENT ; from_atype = to_atype = atype; flags =0 ; -if (!cgroup_bpf_enabled (atype)) - goto skip_count; }else if (type ==BPF_LSM_CGROUP ) {if (!effective_query && attr->query.prog_cnt && prog_ids && !prog_attach_flags)
@@ -1476,7 +1475,6 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, } } -skip_count:/* always output uattr->query.attach_flags as 0 during effective query */ flags = effective_query ?0 : flags;if (copy_to_user (&uattr->query.attach_flags, &flags,sizeof (flags)))
base-commit: 6a75c73eebd4d497ded7d08b47894f9ddbebb5a9
Signature · 1 line
2.53.0-Meta
This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:
Hello:
This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:
Quoted 12 lines · On Thu, 1 Oct 2026 07:19:01 -0700 you wrote:
Two things in
__cgroup_bpf_query()work only becauseCGROUP_TCP_SOCK_OPSis the onlystruct_opsattach type.It calls
cgroup_bpf_enabled(atype)with an atype thatfind_atype_by_struct_ops_id()works out at runtime. That macro is an asm goto and needs a constant. Today the compiler can see there is only one value; add a second type and the build breaks with "impossible constraint in 'asm'". The check is not needed anyway. When the key is off nothing is attached, so progs[atype] and effective[atype] are empty and the count loop leavestotal_cntat 0. The other attach types already use that loop with no such check. Drop the check and theskip_countlabel.
Quoted 1 line
[...]
Here is the summary with links:
- [bpf-next,v2] bpf, cgroup: fix cgroup struct_ops query for a second attach type
https://git.kernel.org/bpf/bpf-next/c/b5a4aa31abd6
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html