[PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[Michal Koutný]

Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
- don't accept zero classid neither (Pablo N. A.)
- eliminate code that might rely on comparison against zero with
  !CONFIG_CGROUP_NET_CLASSID

Michal Koutný (3):
  netfilter: Make xt_cgroup independent from net_cls
  cgroup: Guard users of sock_cgroup_classid()
  cgroup: Drop sock_cgroup_classid() dummy implementation

 include/linux/cgroup-defs.h | 10 ++++------
 net/ipv4/inet_diag.c        |  2 +-
 net/netfilter/Kconfig       |  2 +-
 net/netfilter/xt_cgroup.c   | 26 ++++++++++++++++++++++++++
 4 files changed, 32 insertions(+), 8 deletions(-)


base-commit: dd83757f6e686a2188997cb58b5975f744bb7786
-- 
2.48.1

[PATCH v3 3/3] cgroup: Drop sock_cgroup_classid() dummy implementation

[Michal Koutný]

The semantic of returning 0 is unclear when !CONFIG_CGROUP_NET_CLASSID.
Since there are no callers of sock_cgroup_classid() with that config
anymore we can undefine the helper at all and enforce all (future)
callers to handle cases when !CONFIG_CGROUP_NET_CLASSID.

Signed-off-by: Michal Koutný <mkoutny@suse.com>
---
 include/linux/cgroup-defs.h | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 17960a1e858db..28f33b0807c9a 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -866,14 +866,12 @@ static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)
 #endif
 }
 
+#ifdef CONFIG_CGROUP_NET_CLASSID
 static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)
 {
-#ifdef CONFIG_CGROUP_NET_CLASSID
 	return READ_ONCE(skcd->classid);
-#else
-	return 0;
-#endif
 }
+#endif
 
 static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
 					   u16 prioidx)
@@ -883,13 +881,13 @@ static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
 #endif
 }
 
+#ifdef CONFIG_CGROUP_NET_CLASSID
 static inline void sock_cgroup_set_classid(struct sock_cgroup_data *skcd,
 					   u32 classid)
 {
-#ifdef CONFIG_CGROUP_NET_CLASSID
 	WRITE_ONCE(skcd->classid, classid);
-#endif
 }
+#endif
 
 #else	/* CONFIG_SOCK_CGROUP_DATA */
 
-- 
2.48.1

Re: [PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[Tejun Heo]

On Tue, Apr 01, 2025 at 01:57:29PM +0200, Michal Koutný wrote:
> Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
> - don't accept zero classid neither (Pablo N. A.)
> - eliminate code that might rely on comparison against zero with
>   !CONFIG_CGROUP_NET_CLASSID
> 
> Michal Koutný (3):
>   netfilter: Make xt_cgroup independent from net_cls
>   cgroup: Guard users of sock_cgroup_classid()
>   cgroup: Drop sock_cgroup_classid() dummy implementation

From cgroup POV:

  Acked-by: Tejun Heo <tj@kernel.org>

Once folks are happy, please let me know how the patches should be routed.

Thanks.

-- 
tejun

Re: [PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 631 bytes --]

On Tue, Apr 01, 2025 at 01:57:29PM +0200, Michal Koutný <mkoutny@suse.com> wrote:
> Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
> - don't accept zero classid neither (Pablo N. A.)
> - eliminate code that might rely on comparison against zero with
>   !CONFIG_CGROUP_NET_CLASSID

Pablo, just to break possible dilemma with Tejun's routing [1], it makes
sense to me to route this series together via net(filter) git(s).

Also, let me (anyone) know should there be further remarks to this form.

Thanks,
Michal

[1] https://lore.kernel.org/all/Z-zqvmJFI3PkNl6R@slm.duckdns.org/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[Pablo Neira Ayuso]

On Wed, Apr 09, 2025 at 06:56:17PM +0200, Michal Koutný wrote:
> On Tue, Apr 01, 2025 at 01:57:29PM +0200, Michal Koutný <mkoutny@suse.com> wrote:
> > Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
> > - don't accept zero classid neither (Pablo N. A.)
> > - eliminate code that might rely on comparison against zero with
> >   !CONFIG_CGROUP_NET_CLASSID
> 
> Pablo, just to break possible dilemma with Tejun's routing [1], it makes
> sense to me to route this series together via net(filter) git(s).
> 
> Also, let me (anyone) know should there be further remarks to this form.

I am going to apply 1/3 and 2/3 to nf-next.git

I suggest, then, you follow up to cgroups tree to submit 3/3.

3/3 does not show up in my patchwork for some reason.

Re: [PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

On Tue, Apr 15, 2025 at 05:09:35PM +0200, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> I am going to apply 1/3 and 2/3 to nf-next.git

Thanks.

> I suggest, then, you follow up to cgroups tree to submit 3/3.

OK.

> 3/3 does not show up in my patchwork for some reason.

The reason is -- my invocation of get_maintainer.pl on the 3rd patch
excluded anything netdev. Sorry.

Michal

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]