[PATCHSET v7] Inherited restrictions and BPF filtering for io_uring
From: Jens Axboe
Date: Tue Jan 27 2026 - 13:33:22 EST
Hi,
Followup to v6 here:
https://lore.kernel.org/io-uring/20260119235456.1722452-1-axboe@xxxxxxxxx/
Mostly just addressing a bit of feedback, feature wise this is all the
same as before. See the changelog section for more details.
Kernel branch can be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/log/?h=io_uring-bpf-restrictions.4
and a liburing branch with support helpers, man page, and a fairly
substantial test case can be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/liburing.git/log/?h=bpf-restrictions
Feedback welcome!
Changes since v6
- Add pdu_size to struct io_uring_bpf_ctx. This will help future proof
filters as they can check if they agree with the kernel on what is
available, and it eliminates the need to pad the struct out for future
expansion (Christian)
- Various code cleanups (Christian)
- Fix for FORTIFY on how the bctx filter struct is cleared.
- Rebase on current for-7.0/io_uring tree.
include/linux/io_uring.h | 14 +-
include/linux/io_uring_types.h | 13 +
include/linux/sched.h | 1 +
include/uapi/linux/io_uring.h | 10 +
include/uapi/linux/io_uring/bpf_filter.h | 62 ++++
io_uring/Kconfig | 5 +
io_uring/Makefile | 1 +
io_uring/bpf_filter.c | 430 +++++++++++++++++++++++
io_uring/bpf_filter.h | 48 +++
io_uring/io_uring.c | 48 +++
io_uring/io_uring.h | 1 +
io_uring/net.c | 9 +
io_uring/net.h | 6 +
io_uring/openclose.c | 9 +
io_uring/openclose.h | 3 +
io_uring/register.c | 91 +++++
io_uring/tctx.c | 42 ++-
kernel/fork.c | 5 +
18 files changed, 788 insertions(+), 10 deletions(-)
--
Jens Axboe