On Thu, Oct 10, 2019 at 08:17:49PM +0200, Jakub Sitnicki wrote: > It is currently not possible to detach the flow dissector program and > attach a new one in an atomic fashion, that is with a single syscall. > Attempts to do so will be met with EEXIST error. > > This makes updates to flow dissector program hard. Traffic steering that > relies on BPF-powered flow dissection gets disrupted while old program has > been already detached but the new one has not been attached yet. > > There is also a window of opportunity to attach a flow dissector to a > non-root namespace while updating the root flow dissector, thus blocking > the update. > > Lastly, the behavior is inconsistent with cgroup BPF programs, which can be > replaced with a single bpf(BPF_PROG_ATTACH, ...) syscall without any > restrictions. > > Allow attaching a new flow dissector program when another one is already > present with a restriction that it can't be the same program. Acked-by: Martin KaFai Lau <kafai@xxxxxx>
