libbpf: Add bpf_prog_clone for individual program loading

[kernel-patches-daemon-bpf]

Pull request for series with
subject: libbpf: Add bpf_prog_clone for individual program loading
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330

[kernel-patches-daemon-bpf]

Upstream branch: 4475cda
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 19de32d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-review-bot]

commit d6e7dcb7bdcb8ab7d01b5f2477b42b88bc56d91d
Author: Mykyta Yatsenko <yatsenko@meta.com>

libbpf: Introduce bpf_prog_clone()

This commit adds a new bpf_prog_clone() API that loads a single BPF program
from a prepared BPF object into the kernel. It creates temporary copies of
program-containing maps to avoid owner compatibility conflicts.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 0c8bf0b5cce4..b2d8277a3ef0 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c

[ ... ]

> +static int clone_prog_maps(struct bpf_object *obj, struct bpf_insn *insns,
> +			   size_t insns_cnt, int *temp_fds)
> +{
> +	int i, j, old_fd, new_fd, num_fds = 0;
> +
> +	for (i = 0; i < obj->nr_maps; i++) {
> +		struct bpf_map *map = &obj->maps[i];
> +
> +		if (!map_type_contains_progs(map->def.type))
> +			continue;
> +
> +		old_fd = map->fd;
> +		if (old_fd < 0)
> +			continue;
> +
> +		new_fd = bpf_map_create(map->def.type, map->name,
> +					map->def.key_size, map->def.value_size,
> +					map->def.max_entries, NULL);
> +		if (new_fd < 0)
> +			return -errno;

If bpf_map_create() fails here after successfully creating one or more maps
in previous iterations, the file descriptors stored in temp_fds[] are never
closed. Would it make sense to close temp_fds[0..num_fds-1] before returning
-errno?

> +
> +		for (j = 0; j < insns_cnt; j++) {

[ ... ]

> +		}
> +
> +		temp_fds[num_fds++] = new_fd;
> +	}
> +
> +	return num_fds;
> +}

[ ... ]

---

AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: libbpf: Introduce bpf_prog_clone()
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21929204831

AI-authorship-score: low
AI-authorship-explanation: The code follows established libbpf patterns, uses domain-appropriate terminology, and lacks typical AI generation artifacts; appears to be human-authored.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: File descriptor leak in clone_prog_maps() on partial failure is a resource leak with low severity since it only occurs under unusual error conditions.

[kernel-patches-daemon-bpf]

Forwarding comment 3888110456 via email
In-Reply-To: 20260212-veristat_prepare-v1-1-c351023fb0db@meta.com
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/20260212-veristat_prepare-v1-1-c351023fb0db@meta.com/

[kernel-patches-daemon-bpf]

Upstream branch: a86c608
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: a86c608
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: a86c608
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 561085f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: f632de6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 4c51f90
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1053330
version: 1