Re: [PATCHSET 0/2] cBPF filter API adjustment

[Christian Brauner]

On Wed, Feb 11, 2026 at 08:01:16AM -0700, Jens Axboe wrote:
> Hi,
> 
> Christian brought up a good point on the API - what if the task and
> kernel differ on what the payload size is for an opcode? Currently
> there are two defined payloads, inside struct io_uring_bpf_ctx:
> 
> 	struct {
> 		__u32	family;
> 		__u32	type;
> 		__u32	protocol;
> 	} socket;
> 
> 	struct {
> 		__u64	flags;
> 		__u64	mode;
> 		__u64	resolve;
> 	} open;
> 
> and it could be a requirement that a filter exactly matches the payload
> that the kernel uses, if extensions have been made on the kernel side.
> Hence this small series updates the API slightly:
> 
> struct io_uring_bpf_filter adds a pdu_size field, which userspace can
> set to the size if expects. For an OPENAT/OPENAT2 filter, that would
> be sizeof(struct open) above. The kernel can validate that they match,
> where the mismatch policy is controlled by userspace. See patch 2 for
> details. In case of a mismatch that causes an error, the kernel side
> pdu_size is copied back to userspace.
> 
> Patch 1 exposes the pdu_size by shoving the filtering and pdu_size
> into the issue side definitions, and patch 2 implements the above
> size checking.
> 
> The liburing master branch has been updated as well for this, as
> copying back the pdu_size necessitates changing the API on that side.
> Test cases and man pages are updated as well.

Seems fine by me,
Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>