Re: [PATCH v5 bpf-next 04/10] bpf: tcp: Guard fast-path bpf_tcp_ops_call() under per-socket flag.

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] tcp: stale saw_unknown flag partially defeats bpf_tcp_ops optimization
--

commit f118f1505af0dead6c4ecc71acf79379acbf604a
Author: Kuniyuki Iwashima <kuniyu@google.com>

    bpf: tcp: Guard fast-path bpf_tcp_ops_call() under per-socket flag.
    
    bpf_tcp_ops.{parse_hdr,hdr_opt_len} are called for every
    incoming / outgoing skb.
    
    bpf_tcp_ops.rtt is called once per RTT, which is every
    incoming skb in ping-pong workloads like tcp_rr.
    
    Even attaching NULL callbacks in the fast path hurts performance.
    
    Let's guard them (and write_hdr_opt) with the new per-socket flags.

> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index 209db8effcc41..4478d3f3d4b02 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
[ ... ]
> @@ -217,7 +222,12 @@ static void bpf_tcp_ops_parse_hdr(struct sock *sk, struct sk_buff *skb)
>  		return;
>  	}
>  
> -	bpf_tcp_ops_call(parse_hdr, sk, skb);
> +	tp = tcp_sk(sk);
> +
> +	if ((tp->rx_opt.saw_unknown &&
> +	     BPF_TCP_OPS_TEST_FLAG(tp, PARSE_HDR_OPT_UNKNOWN)) ||
> +	    BPF_TCP_OPS_TEST_FLAG(tp, PARSE_HDR_OPT_ALL))
> +		__bpf_tcp_ops_call(parse_hdr, sk, skb);
>  }

[Severity: Low]
Does this optimization rely on tp->rx_opt.saw_unknown being correctly cleared
for packets without unknown options?

Looking at tcp_fast_parse_options(), the fast parse path clears other option
state flags but fails to clear saw_unknown:

net/ipv4/tcp_input.c:tcp_fast_parse_options() {
	if (th->doff == (sizeof(*th) / 4)) {
		tp->rx_opt.saw_tstamp = 0;
		tp->rx_opt.accecn = 0;
		return false;
	}
...
}

If a previous packet had an unknown option and set saw_unknown, could
subsequent packets that take the fast parse path retain the stale saw_unknown
value, causing the BPF program to be invoked spuriously and partially
defeating this optimization?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008031604.256498-1-kuniyu@google.com?part=4