Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[1.2] cgroups: ebpf: use link.Anchor to check for BPF_F_REPLACE support #4551

Merged
merged 3 commits into from
Dec 7, 2024
+14 −8
Merged

[1.2] cgroups: ebpf: use link.Anchor to check for BPF_F_REPLACE support #4551

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e623414
[1.2] cgroups: ebpf: use link.Anchor to check for BPF_F_REPLACE support
cyphar Dec 6, 2024
e26e0fd
[1.2] cgroups: ebpf: also check for ebpf.ErrNotSupported
cyphar Dec 6, 2024
7242ffa
[1.2] cgroup: ebpf: make unexpected errors in haveBpfProgReplace louder
cyphar Dec 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions libcontainer/cgroups/devices/ebpf_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,14 +107,14 @@ func haveBpfProgReplace() bool {
},
})
if err != nil {
logrus.Debugf("checking for BPF_F_REPLACE support: ebpf.NewProgram failed: %v", err)
logrus.Warnf("checking for BPF_F_REPLACE support: ebpf.NewProgram failed: %v", err)
return
}
defer prog.Close()

devnull, err := os.Open("/dev/null")
if err != nil {
logrus.Debugf("checking for BPF_F_REPLACE support: open dummy target fd: %v", err)
logrus.Warnf("checking for BPF_F_REPLACE support: open dummy target fd: %v", err)
return
}
defer devnull.Close()
Expand All @@ -123,20 +123,26 @@ func haveBpfProgReplace() bool {
// BPF_CGROUP_DEVICE programs. If passing BPF_F_REPLACE gives us EINVAL
// we know that the feature isn't present.
err = link.RawAttachProgram(link.RawAttachProgramOptions{
// We rely on this fd being checked after attachFlags.
// We rely on this fd being checked after attachFlags in the kernel.
Target: int(devnull.Fd()),
// Attempt to "replace" bad fds with this program.
// Attempt to "replace" our BPF program with itself. This will
// always fail, but we should get -EINVAL if BPF_F_REPLACE is not
// supported.
Anchor: link.ReplaceProgram(prog),
Program: prog,
Attach: ebpf.AttachCGroupDevice,
Flags: unix.BPF_F_ALLOW_MULTI | unix.BPF_F_REPLACE,
Flags: unix.BPF_F_ALLOW_MULTI,
})
if errors.Is(err, unix.EINVAL) {
if errors.Is(err, ebpf.ErrNotSupported) || errors.Is(err, unix.EINVAL) {
// not supported
return
}
// attach_flags test succeeded.
if !errors.Is(err, unix.EBADF) {
logrus.Debugf("checking for BPF_F_REPLACE: got unexpected (not EBADF or EINVAL) error: %v", err)
// If we see any new errors here, it's possible that there is a
// regression due to a cilium/ebpf update and the above EINVAL
// checks are not working. So, be loud about it so someone notices
// and we can get the issue fixed quicker.
logrus.Warnf("checking for BPF_F_REPLACE: got unexpected (not EBADF or EINVAL) error: %v", err)
}
haveBpfProgReplaceBool = true
})
Expand Down
Loading