From 501fa6c60d303f0d6e747939172281d77247626e Mon Sep 17 00:00:00 2001 From: Alexander Filippov Date: Mon, 17 Sep 2018 13:33:06 +0300 Subject: [PATCH] core: fix the check if CONFIG_CGROUP_BPF is on Since the commit torvalds/linux@fdb5c4531c1e0e50e609df83f736b6f3a02896e2 the syscall BPF_PROG_ATTACH return EBADF when CONFIG_CGROUP_BPF is turned off and as result the bpf_firewall_supported() returns the incorrect value. This commmit replaces the syscall BPF_PROG_ATTACH with BPF_PROG_DETACH which is still work as expected. Resolves openbmc/linux#159 See also systemd/systemd#7054 Signed-off-by: Alexander Filippov --- src/core/bpf-firewall.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c index f3f40fb0e8..51dc5b9506 100644 --- a/src/core/bpf-firewall.c +++ b/src/core/bpf-firewall.c @@ -658,7 +658,7 @@ int bpf_firewall_supported(void) { * b) whether the unified hierarchy is being used * c) the BPF implementation in the kernel supports BPF LPM TRIE maps, which we require * d) the BPF implementation in the kernel supports BPF_PROG_TYPE_CGROUP_SKB programs, which we require - * e) the BPF implementation in the kernel supports the BPF_PROG_ATTACH call, which we require + * e) the BPF implementation in the kernel supports the BPF_PROG_DETACH call, which we require * */ @@ -711,7 +711,7 @@ int bpf_firewall_supported(void) { * is turned off at kernel compilation time. This sucks of course: why does it allow us to create a cgroup BPF * program if we can't do a thing with it later? * - * We detect this case by issuing the BPF_PROG_ATTACH bpf() call with invalid file descriptors: if + * We detect this case by issuing the BPF_PROG_DETACH bpf() call with invalid file descriptors: if * CONFIG_CGROUP_BPF is turned off, then the call will fail early with EINVAL. If it is turned on the * parameters are validated however, and that'll fail with EBADF then. */ @@ -721,14 +721,14 @@ int bpf_firewall_supported(void) { .attach_bpf_fd = -1, }; - r = bpf(BPF_PROG_ATTACH, &attr, sizeof(attr)); + r = bpf(BPF_PROG_DETACH, &attr, sizeof(attr)); if (r < 0) { if (errno == EBADF) /* YAY! */ return supported = true; - log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_ATTACH, BPF firewalling is not supported: %m"); + log_debug_errno(errno, "Didn't get EBADF from BPF_PROG_DETACH, BPF firewalling is not supported: %m"); } else - log_debug("Wut? kernel accepted our invalid BPF_PROG_ATTACH call? Something is weird, assuming BPF firewalling is broken and hence not supported."); + log_debug("Wut? kernel accepted our invalid BPF_PROG_DETACH call? Something is weird, assuming BPF firewalling is broken and hence not supported."); return supported = false; } -- 2.14.4