commit 1ab3ad8afa1faef99f1b064a2833a7349a284a62
author Maciej Żenczykowski <maze@google.com> Thu Aug 22 17:30:20 2024 +0000
committer Maciej Żenczykowski <maze@google.com> Thu Aug 22 17:30:38 2024 +0000
tree 90e0b04c65f8c16c9269766b186914f4e8acdf8b
parent f8a4a5d3be0d032bfe8564b454fbb9439194bb04

dscpPolicy: minor optimization for verifier

Bug: 361492282
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I39de974cf056d3e268e1740da90c2af05b5a60b4

bpf/progs/dscpPolicy.c

diff --git a/bpf/progs/dscpPolicy.c b/bpf/progs/dscpPolicy.c
index 93542ee..4bdd3ed 100644
--- a/bpf/progs/dscpPolicy.c
+++ b/bpf/progs/dscpPolicy.c
@@ -28,7 +28,7 @@
 DEFINE_BPF_MAP_GRW(ipv4_dscp_policies_map, ARRAY, uint32_t, DscpPolicy, MAX_POLICIES, AID_SYSTEM)
 DEFINE_BPF_MAP_GRW(ipv6_dscp_policies_map, ARRAY, uint32_t, DscpPolicy, MAX_POLICIES, AID_SYSTEM)
 
-static inline __always_inline void match_policy(struct __sk_buff* skb, bool ipv4) {
+static inline __always_inline void match_policy(struct __sk_buff* skb, const bool ipv4) {
     void* data = (void*)(long)skb->data;
     const void* data_end = (void*)(long)skb->data_end;
 
@@ -145,8 +145,10 @@
             policy = bpf_ipv6_dscp_policies_map_lookup_elem(&key);
         }
 
-        // If the policy lookup failed, just continue (this should not ever happen)
-        if (!policy) continue;
+        // Lookup failure cannot happen on an array with MAX_POLICIES entries.
+        // While 'continue' would make logical sense here, 'return' should be
+        // easier for the verifier to analyze.
+        if (!policy) return;
 
         // If policy iface index does not match skb, then skip to next policy.
         if (policy->ifindex != skb->ifindex) continue;