File 0036-bpf-program-optionally-take-fd-of-program-... of Package systemd

Overview Repositories Revisions Requests Users Attributes Meta

File 0036-bpf-program-optionally-take-fd-of-program-to-detach.patch of Package systemd (Revision 2a0ef622b860d89b09df9bc0f43c3432)

Currently displaying revision 2a0ef622b860d89b09df9bc0f43c3432 , Show latest

From 6b0ba129762b83d74a25f97741ca86ec38463304 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 16 Feb 2018 14:58:12 +0100
Subject: [PATCH 36/51] bpf-program: optionally take fd of program to detach

This is useful for BPF_F_ALLOW_MULTI programs, where the kernel requires
us to specify the fd.

(cherry picked from commit 9b3c189786a637fbd3b402a1c09626cb831c0fd3)
---
 src/basic/bpf-program.c | 7 ++++++-
 src/basic/bpf-program.h | 2 +-
 src/core/bpf-firewall.c | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/basic/bpf-program.c b/src/basic/bpf-program.c
index ce6f9e4409..8f59ebd958 100644
--- a/src/basic/bpf-program.c
+++ b/src/basic/bpf-program.c
@@ -116,12 +116,16 @@ int bpf_program_cgroup_attach(BPFProgram *p, int type, const char *path, uint32_
         return 0;
 }
 
-int bpf_program_cgroup_detach(int type, const char *path) {
+int bpf_program_cgroup_detach(BPFProgram *p, int type, const char *path) {
         _cleanup_close_ int fd = -1;
         union bpf_attr attr;
 
+        assert(type >= 0);
         assert(path);
 
+        /* Note that 'p' may be NULL, in which case any program is detached. However, note that if BPF_F_ALLOW_MULTI is
+         * used 'p' is not optional. */
+
         fd = open(path, O_DIRECTORY|O_RDONLY|O_CLOEXEC);
         if (fd < 0)
                 return -errno;
@@ -129,6 +133,7 @@ int bpf_program_cgroup_detach(int type, const char *path) {
         attr = (union bpf_attr) {
                 .attach_type = type,
                 .target_fd = fd,
+                .attach_bpf_fd = p ? p->kernel_fd : -1,
         };
 
         if (bpf(BPF_PROG_DETACH, &attr, sizeof(attr)) < 0)
diff --git a/src/basic/bpf-program.h b/src/basic/bpf-program.h
index 35a41ffc44..8be70b28a1 100644
--- a/src/basic/bpf-program.h
+++ b/src/basic/bpf-program.h
@@ -46,7 +46,7 @@ int bpf_program_add_instructions(BPFProgram *p, const struct bpf_insn *insn, siz
 int bpf_program_load_kernel(BPFProgram *p, char *log_buf, size_t log_size);
 
 int bpf_program_cgroup_attach(BPFProgram *p, int type, const char *path, uint32_t flags);
-int bpf_program_cgroup_detach(int type, const char *path);
+int bpf_program_cgroup_detach(BPFProgram *p, int type, const char *path);
 
 int bpf_map_new(enum bpf_map_type type, size_t key_size, size_t value_size, size_t max_entries, uint32_t flags);
 int bpf_map_update_element(int fd, const void *key, void *value);
diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c
index 5b1dfe3c14..5f76866d1f 100644
--- a/src/core/bpf-firewall.c
+++ b/src/core/bpf-firewall.c
@@ -572,7 +572,7 @@ int bpf_firewall_install(Unit *u) {
                 if (r < 0)
                         return log_error_errno(r, "Attaching egress BPF program to cgroup %s failed: %m", path);
         } else {
-                r = bpf_program_cgroup_detach(BPF_CGROUP_INET_EGRESS, path);
+                r = bpf_program_cgroup_detach(NULL, BPF_CGROUP_INET_EGRESS, path);
                 if (r < 0)
                         return log_full_errno(r == -ENOENT ? LOG_DEBUG : LOG_ERR, r,
                                               "Detaching egress BPF program from cgroup failed: %m");
@@ -587,7 +587,7 @@ int bpf_firewall_install(Unit *u) {
                 if (r < 0)
                         return log_error_errno(r, "Attaching ingress BPF program to cgroup %s failed: %m", path);
         } else {
-                r = bpf_program_cgroup_detach(BPF_CGROUP_INET_INGRESS, path);
+                r = bpf_program_cgroup_detach(NULL, BPF_CGROUP_INET_INGRESS, path);
                 if (r < 0)
                         return log_full_errno(r == -ENOENT ? LOG_DEBUG : LOG_ERR, r,
                                               "Detaching ingress BPF program from cgroup failed: %m");
-- 
2.16.4

Places

File 0036-bpf-program-optionally-take-fd-of-program-to-detach.patch of Package systemd (Revision 2a0ef622b860d89b09df9bc0f43c3432)

Places