1
0
mirror of https://github.com/systemd/systemd.git synced 2025-01-10 05:18:17 +03:00

Merge pull request #33258 from YHNdnzj/cg-runtime-accounting

core/cgroup: various fixes for accounting
This commit is contained in:
Mike Yuan 2024-06-29 16:11:44 +02:00 committed by GitHub
commit 7fee3dd4c6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
14 changed files with 126 additions and 181 deletions

View File

@ -970,12 +970,8 @@ void emit_bpf_firewall_warning(Unit *u) {
warned = true;
}
void bpf_firewall_close(Unit *u) {
assert(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt)
return;
void bpf_firewall_close(CGroupRuntime *crt) {
assert(crt);
crt->ip_accounting_ingress_map_fd = safe_close(crt->ip_accounting_ingress_map_fd);
crt->ip_accounting_egress_map_fd = safe_close(crt->ip_accounting_egress_map_fd);

View File

@ -3,6 +3,7 @@
#include <inttypes.h>
#include "cgroup.h"
#include "unit.h"
enum {
@ -22,4 +23,4 @@ int bpf_firewall_reset_accounting(int map_fd);
void emit_bpf_firewall_warning(Unit *u);
void bpf_firewall_close(Unit *u);
void bpf_firewall_close(CGroupRuntime *crt);

View File

@ -102,8 +102,9 @@ bool unit_has_startup_cgroup_constraints(Unit *u) {
c->startup_memory_low_set;
}
bool unit_has_host_root_cgroup(Unit *u) {
bool unit_has_host_root_cgroup(const Unit *u) {
assert(u);
assert(u->manager);
/* Returns whether this unit manages the root cgroup. This will return true if this unit is the root slice and
* the manager manages the root cgroup. */
@ -2685,7 +2686,7 @@ int unit_set_cgroup_path(Unit *u, const char *path) {
if (crt && streq_ptr(crt->cgroup_path, path))
return 0;
unit_release_cgroup(u);
unit_release_cgroup(u, /* drop_cgroup_runtime = */ true);
crt = unit_setup_cgroup_runtime(u);
if (!crt)
@ -3483,7 +3484,7 @@ int unit_realize_cgroup(Unit *u) {
return unit_realize_cgroup_now(u, manager_state(u->manager));
}
void unit_release_cgroup(Unit *u) {
void unit_release_cgroup(Unit *u, bool drop_cgroup_runtime) {
assert(u);
/* Forgets all cgroup details for this cgroup — but does *not* destroy the cgroup. This is hence OK to call
@ -3514,7 +3515,8 @@ void unit_release_cgroup(Unit *u) {
crt->cgroup_memory_inotify_wd = -1;
}
*(CGroupRuntime**) ((uint8_t*) u + UNIT_VTABLE(u)->cgroup_runtime_offset) = cgroup_runtime_free(crt);
if (drop_cgroup_runtime)
*(CGroupRuntime**) ((uint8_t*) u + UNIT_VTABLE(u)->cgroup_runtime_offset) = cgroup_runtime_free(crt);
}
int unit_cgroup_is_empty(Unit *u) {
@ -3530,27 +3532,28 @@ int unit_cgroup_is_empty(Unit *u) {
r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, crt->cgroup_path);
if (r < 0)
return log_unit_debug_errno(u, r, "Failed to determine whether cgroup %s is empty, ignoring: %m", empty_to_root(crt->cgroup_path));
log_unit_debug_errno(u, r, "Failed to determine whether cgroup %s is empty: %m", empty_to_root(crt->cgroup_path));
return r;
}
bool unit_maybe_release_cgroup(Unit *u) {
static bool unit_maybe_release_cgroup(Unit *u) {
int r;
assert(u);
/* Releases the cgroup only if it is recursively empty.
* Returns true if the cgroup was released, false otherwise. */
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return true;
assert(u);
/* Don't release the cgroup if there are still processes under it. If we get notified later when all
* the processes exit (e.g. the processes were in D-state and exited after the unit was marked as
* failed) we need the cgroup paths to continue to be tracked by the manager so they can be looked up
* and cleaned up later. */
r = unit_cgroup_is_empty(u);
if (r == 1) {
unit_release_cgroup(u);
if (r > 0) {
/* Do not free CGroupRuntime when called from unit_prune_cgroup. Various accounting data
* we should keep, especially CPU usage and *_peak ones which would be shown even after
* the unit stops. */
unit_release_cgroup(u, /* drop_cgroup_runtime = */ false);
return true;
}
@ -3558,8 +3561,8 @@ bool unit_maybe_release_cgroup(Unit *u) {
}
void unit_prune_cgroup(Unit *u) {
int r;
bool is_root_slice;
int r;
assert(u);
@ -3597,9 +3600,8 @@ void unit_prune_cgroup(Unit *u) {
if (!unit_maybe_release_cgroup(u)) /* Returns true if the cgroup was released */
return;
crt = unit_get_cgroup_runtime(u); /* The above might have destroyed the runtime object, let's see if it's still there */
if (!crt)
return;
assert(crt == unit_get_cgroup_runtime(u));
assert(!crt->cgroup_path);
crt->cgroup_realized = false;
crt->cgroup_realized_mask = 0;
@ -4526,6 +4528,10 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
if (!UNIT_CGROUP_BOOL(u, memory_accounting))
return -ENODATA;
/* The root cgroup doesn't expose this information. */
if (unit_has_host_root_cgroup(u))
return -ENODATA;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt)
return -ENODATA;
@ -4533,10 +4539,6 @@ int unit_get_memory_accounting(Unit *u, CGroupMemoryAccountingMetric metric, uin
/* If the cgroup is already gone, we try to find the last cached value. */
goto finish;
/* The root cgroup doesn't expose this information. */
if (unit_has_host_root_cgroup(u))
return -ENODATA;
if (!FLAGS_SET(crt->cgroup_realized_mask, CGROUP_MASK_MEMORY))
return -ENODATA;
@ -4592,15 +4594,14 @@ int unit_get_tasks_current(Unit *u, uint64_t *ret) {
return cg_get_attribute_as_uint64("pids", crt->cgroup_path, "pids.current", ret);
}
static int unit_get_cpu_usage_raw(Unit *u, nsec_t *ret) {
uint64_t ns;
static int unit_get_cpu_usage_raw(const Unit *u, const CGroupRuntime *crt, nsec_t *ret) {
int r;
assert(u);
assert(crt);
assert(ret);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
if (!crt->cgroup_path)
return -ENODATA;
/* The root cgroup doesn't expose this information, let's get it from /proc instead */
@ -4614,25 +4615,24 @@ static int unit_get_cpu_usage_raw(Unit *u, nsec_t *ret) {
r = cg_all_unified();
if (r < 0)
return r;
if (r > 0) {
_cleanup_free_ char *val = NULL;
uint64_t us;
r = cg_get_keyed_attribute("cpu", crt->cgroup_path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
if (IN_SET(r, -ENOENT, -ENXIO))
return -ENODATA;
if (r < 0)
return r;
r = safe_atou64(val, &us);
if (r < 0)
return r;
ns = us * NSEC_PER_USEC;
} else
if (r == 0)
return cg_get_attribute_as_uint64("cpuacct", crt->cgroup_path, "cpuacct.usage", ret);
*ret = ns;
_cleanup_free_ char *val = NULL;
uint64_t us;
r = cg_get_keyed_attribute("cpu", crt->cgroup_path, "cpu.stat", STRV_MAKE("usage_usec"), &val);
if (IN_SET(r, -ENOENT, -ENXIO))
return -ENODATA;
if (r < 0)
return r;
r = safe_atou64(val, &us);
if (r < 0)
return r;
*ret = us * NSEC_PER_USEC;
return 0;
}
@ -4646,14 +4646,14 @@ int unit_get_cpu_usage(Unit *u, nsec_t *ret) {
* started. If the cgroup has been removed already, returns the last cached value. To cache the value, simply
* call this function with a NULL return value. */
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return -ENODATA;
if (!UNIT_CGROUP_BOOL(u, cpu_accounting))
return -ENODATA;
r = unit_get_cpu_usage_raw(u, &ns);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt)
return -ENODATA;
r = unit_get_cpu_usage_raw(u, crt, &ns);
if (r == -ENODATA && crt->cpu_usage_last != NSEC_INFINITY) {
/* If we can't get the CPU usage anymore (because the cgroup was already removed, for example), use our
* cached value. */
@ -4694,7 +4694,7 @@ int unit_get_ip_accounting(
return -ENODATA;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
if (!crt)
return -ENODATA;
fd = IN_SET(metric, CGROUP_IP_INGRESS_BYTES, CGROUP_IP_INGRESS_PACKETS) ?
@ -4770,22 +4770,27 @@ int unit_get_effective_limit(Unit *u, CGroupLimitType type, uint64_t *ret) {
return 0;
}
static int unit_get_io_accounting_raw(Unit *u, uint64_t ret[static _CGROUP_IO_ACCOUNTING_METRIC_MAX]) {
static const char *const field_names[_CGROUP_IO_ACCOUNTING_METRIC_MAX] = {
static int unit_get_io_accounting_raw(
const Unit *u,
const CGroupRuntime *crt,
uint64_t ret[static _CGROUP_IO_ACCOUNTING_METRIC_MAX]) {
static const char* const field_names[_CGROUP_IO_ACCOUNTING_METRIC_MAX] = {
[CGROUP_IO_READ_BYTES] = "rbytes=",
[CGROUP_IO_WRITE_BYTES] = "wbytes=",
[CGROUP_IO_READ_OPERATIONS] = "rios=",
[CGROUP_IO_WRITE_OPERATIONS] = "wios=",
};
uint64_t acc[_CGROUP_IO_ACCOUNTING_METRIC_MAX] = {};
_cleanup_free_ char *path = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
assert(u);
assert(crt);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
if (!crt->cgroup_path)
return -ENODATA;
if (unit_has_host_root_cgroup(u))
@ -4869,13 +4874,13 @@ int unit_get_io_accounting(
return -ENODATA;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
if (!crt)
return -ENODATA;
if (allow_cache && crt->io_accounting_last[metric] != UINT64_MAX)
goto done;
r = unit_get_io_accounting_raw(u, raw);
r = unit_get_io_accounting_raw(u, crt, raw);
if (r == -ENODATA && crt->io_accounting_last[metric] != UINT64_MAX)
goto done;
if (r < 0)
@ -4896,45 +4901,52 @@ done:
return 0;
}
int unit_reset_cpu_accounting(Unit *u) {
static int unit_reset_cpu_accounting(Unit *unit, CGroupRuntime *crt) {
int r;
assert(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return 0;
assert(crt);
crt->cpu_usage_base = 0;
crt->cpu_usage_last = NSEC_INFINITY;
r = unit_get_cpu_usage_raw(u, &crt->cpu_usage_base);
if (r < 0) {
crt->cpu_usage_base = 0;
return r;
if (unit) {
r = unit_get_cpu_usage_raw(unit, crt, &crt->cpu_usage_base);
if (r < 0 && r != -ENODATA)
return r;
}
return 0;
}
void unit_reset_memory_accounting_last(Unit *u) {
assert(u);
static int unit_reset_io_accounting(Unit *unit, CGroupRuntime *crt) {
int r;
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return;
assert(crt);
zero(crt->io_accounting_base);
FOREACH_ELEMENT(i, crt->io_accounting_last)
*i = UINT64_MAX;
if (unit) {
r = unit_get_io_accounting_raw(unit, crt, crt->io_accounting_base);
if (r < 0 && r != -ENODATA)
return r;
}
return 0;
}
static void cgroup_runtime_reset_memory_accounting_last(CGroupRuntime *crt) {
assert(crt);
FOREACH_ELEMENT(i, crt->memory_accounting_last)
*i = UINT64_MAX;
}
int unit_reset_ip_accounting(Unit *u) {
static int cgroup_runtime_reset_ip_accounting(CGroupRuntime *crt) {
int r = 0;
assert(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return 0;
assert(crt);
if (crt->ip_accounting_ingress_map_fd >= 0)
RET_GATHER(r, bpf_firewall_reset_accounting(crt->ip_accounting_ingress_map_fd));
@ -4947,46 +4959,19 @@ int unit_reset_ip_accounting(Unit *u) {
return r;
}
void unit_reset_io_accounting_last(Unit *u) {
assert(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return;
FOREACH_ARRAY(i, crt->io_accounting_last, _CGROUP_IO_ACCOUNTING_METRIC_MAX)
*i = UINT64_MAX;
}
int unit_reset_io_accounting(Unit *u) {
int r;
assert(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_path)
return 0;
unit_reset_io_accounting_last(u);
r = unit_get_io_accounting_raw(u, crt->io_accounting_base);
if (r < 0) {
zero(crt->io_accounting_base);
return r;
}
return 0;
}
int unit_reset_accounting(Unit *u) {
int r = 0;
assert(u);
RET_GATHER(r, unit_reset_cpu_accounting(u));
RET_GATHER(r, unit_reset_io_accounting(u));
RET_GATHER(r, unit_reset_ip_accounting(u));
unit_reset_memory_accounting_last(u);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt)
return 0;
cgroup_runtime_reset_memory_accounting_last(crt);
RET_GATHER(r, unit_reset_cpu_accounting(u, crt));
RET_GATHER(r, unit_reset_io_accounting(u, crt));
RET_GATHER(r, cgroup_runtime_reset_ip_accounting(crt));
return r;
}
@ -5134,7 +5119,7 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action) {
unit_next_freezer_state(u, action, &next, &target);
CGroupRuntime *crt = unit_get_cgroup_runtime(u);
if (!crt || !crt->cgroup_realized) {
if (!crt || !crt->cgroup_path) {
/* No realized cgroup = nothing to freeze */
u->freezer_state = freezer_state_finish(next);
return 0;
@ -5210,7 +5195,7 @@ int unit_get_cpuset(Unit *u, CPUSet *cpus, const char *name) {
return parse_cpu_set_full(v, cpus, false, NULL, NULL, 0, NULL);
}
CGroupRuntime *cgroup_runtime_new(void) {
CGroupRuntime* cgroup_runtime_new(void) {
_cleanup_(cgroup_runtime_freep) CGroupRuntime *crt = NULL;
crt = new(CGroupRuntime, 1);
@ -5218,8 +5203,6 @@ CGroupRuntime *cgroup_runtime_new(void) {
return NULL;
*crt = (CGroupRuntime) {
.cpu_usage_last = NSEC_INFINITY,
.cgroup_control_inotify_wd = -1,
.cgroup_memory_inotify_wd = -1,
@ -5234,19 +5217,15 @@ CGroupRuntime *cgroup_runtime_new(void) {
.cgroup_invalidated_mask = _CGROUP_MASK_ALL,
};
FOREACH_ELEMENT(i, crt->memory_accounting_last)
*i = UINT64_MAX;
FOREACH_ELEMENT(i, crt->io_accounting_base)
*i = UINT64_MAX;
FOREACH_ELEMENT(i, crt->io_accounting_last)
*i = UINT64_MAX;
FOREACH_ELEMENT(i, crt->ip_accounting_extra)
*i = UINT64_MAX;
unit_reset_cpu_accounting(/* unit = */ NULL, crt);
unit_reset_io_accounting(/* unit = */ NULL, crt);
cgroup_runtime_reset_memory_accounting_last(crt);
assert_se(cgroup_runtime_reset_ip_accounting(crt) >= 0);
return TAKE_PTR(crt);
}
CGroupRuntime *cgroup_runtime_free(CGroupRuntime *crt) {
CGroupRuntime* cgroup_runtime_free(CGroupRuntime *crt) {
if (!crt)
return NULL;
@ -5265,20 +5244,7 @@ CGroupRuntime *cgroup_runtime_free(CGroupRuntime *crt) {
#endif
fdset_free(crt->initial_restrict_ifaces_link_fds);
safe_close(crt->ipv4_allow_map_fd);
safe_close(crt->ipv6_allow_map_fd);
safe_close(crt->ipv4_deny_map_fd);
safe_close(crt->ipv6_deny_map_fd);
bpf_program_free(crt->ip_bpf_ingress);
bpf_program_free(crt->ip_bpf_ingress_installed);
bpf_program_free(crt->ip_bpf_egress);
bpf_program_free(crt->ip_bpf_egress_installed);
set_free(crt->ip_bpf_custom_ingress);
set_free(crt->ip_bpf_custom_ingress_installed);
set_free(crt->ip_bpf_custom_egress);
set_free(crt->ip_bpf_custom_egress_installed);
bpf_firewall_close(crt);
free(crt->cgroup_path);

View File

@ -449,10 +449,7 @@ int unit_watch_cgroup_memory(Unit *u);
void unit_add_to_cgroup_realize_queue(Unit *u);
int unit_cgroup_is_empty(Unit *u);
void unit_release_cgroup(Unit *u);
/* Releases the cgroup only if it is recursively empty.
* Returns true if the cgroup was released, false otherwise. */
bool unit_maybe_release_cgroup(Unit *u);
void unit_release_cgroup(Unit *u, bool drop_cgroup_runtime);
void unit_add_to_cgroup_empty_queue(Unit *u);
int unit_check_oomd_kill(Unit *u);
@ -489,21 +486,16 @@ int unit_get_io_accounting(Unit *u, CGroupIOAccountingMetric metric, bool allow_
int unit_get_ip_accounting(Unit *u, CGroupIPAccountingMetric metric, uint64_t *ret);
int unit_get_effective_limit(Unit *u, CGroupLimitType type, uint64_t *ret);
int unit_reset_cpu_accounting(Unit *u);
void unit_reset_memory_accounting_last(Unit *u);
int unit_reset_ip_accounting(Unit *u);
void unit_reset_io_accounting_last(Unit *u);
int unit_reset_io_accounting(Unit *u);
int unit_reset_accounting(Unit *u);
#define UNIT_CGROUP_BOOL(u, name) \
({ \
CGroupContext *cc = unit_get_cgroup_context(u); \
cc ? cc->name : false; \
#define UNIT_CGROUP_BOOL(u, name) \
({ \
CGroupContext *cc = unit_get_cgroup_context(u); \
cc ? cc->name : false; \
})
bool manager_owns_host_root_cgroup(Manager *m);
bool unit_has_host_root_cgroup(Unit *u);
bool unit_has_host_root_cgroup(const Unit *u);
bool unit_has_startup_cgroup_constraints(Unit *u);
@ -527,8 +519,8 @@ int unit_cgroup_freezer_action(Unit *u, FreezerAction action);
const char* freezer_action_to_string(FreezerAction a) _const_;
FreezerAction freezer_action_from_string(const char *s) _pure_;
CGroupRuntime *cgroup_runtime_new(void);
CGroupRuntime *cgroup_runtime_free(CGroupRuntime *crt);
CGroupRuntime* cgroup_runtime_new(void);
CGroupRuntime* cgroup_runtime_free(CGroupRuntime *crt);
DEFINE_TRIVIAL_CLEANUP_FUNC(CGroupRuntime*, cgroup_runtime_free);
int cgroup_runtime_serialize(Unit *u, FILE *f, FDSet *fds);

View File

@ -193,7 +193,7 @@ int bus_mount_set_property(
int bus_mount_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -249,7 +249,7 @@ int bus_scope_set_property(
int bus_scope_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -785,7 +785,7 @@ int bus_service_set_property(
int bus_service_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -28,7 +28,7 @@ int bus_slice_set_property(
int bus_slice_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -468,7 +468,7 @@ int bus_socket_set_property(
int bus_socket_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -49,7 +49,7 @@ int bus_swap_set_property(
int bus_swap_commit_properties(Unit *u) {
assert(u);
unit_realize_cgroup(u);
(void) unit_realize_cgroup(u);
return 0;
}

View File

@ -764,10 +764,8 @@ static int mount_coldplug(Unit *u) {
return r;
}
if (!IN_SET(m->deserialized_state, MOUNT_DEAD, MOUNT_FAILED)) {
if (!IN_SET(m->deserialized_state, MOUNT_DEAD, MOUNT_FAILED))
(void) unit_setup_exec_runtime(u);
(void) unit_setup_cgroup_runtime(u);
}
mount_set_state(m, m->deserialized_state);
return 0;

View File

@ -1366,7 +1366,6 @@ static int service_coldplug(Unit *u) {
SERVICE_DEAD_RESOURCES_PINNED)) {
(void) unit_enqueue_rewatch_pids(u);
(void) unit_setup_exec_runtime(u);
(void) unit_setup_cgroup_runtime(u);
}
if (IN_SET(s->deserialized_state, SERVICE_START_POST, SERVICE_RUNNING, SERVICE_RELOAD, SERVICE_RELOAD_SIGNAL, SERVICE_RELOAD_NOTIFY))

View File

@ -548,10 +548,8 @@ static int swap_coldplug(Unit *u) {
return r;
}
if (!IN_SET(new_state, SWAP_DEAD, SWAP_FAILED)) {
if (!IN_SET(new_state, SWAP_DEAD, SWAP_FAILED))
(void) unit_setup_exec_runtime(u);
(void) unit_setup_cgroup_runtime(u);
}
swap_set_state(s, new_state);
return 0;

View File

@ -129,9 +129,6 @@ Unit* unit_new(Manager *m, size_t size) {
.burst = 16
};
unit_reset_memory_accounting_last(u);
unit_reset_io_accounting_last(u);
return u;
}
@ -484,8 +481,8 @@ bool unit_may_gc(Unit *u) {
/* If the unit has a cgroup, then check whether there's anything in it. If so, we should stay
* around. Units with active processes should never be collected. */
r = unit_cgroup_is_empty(u);
if (r <= 0 && r != -ENXIO)
return false; /* ENXIO means: currently not realized */
if (r <= 0 && !IN_SET(r, -ENXIO, -EOWNERDEAD))
return false; /* ENXIO/EOWNERDEAD means: currently not realized */
if (!UNIT_VTABLE(u)->may_gc)
return true;
@ -790,7 +787,7 @@ Unit* unit_free(Unit *u) {
if (u->on_console)
manager_unref_console(u->manager);
unit_release_cgroup(u);
unit_release_cgroup(u, /* drop_cgroup_runtime = */ true);
if (!MANAGER_IS_RELOADING(u->manager))
unit_unlink_state_files(u);
@ -844,8 +841,6 @@ Unit* unit_free(Unit *u) {
if (u->in_release_resources_queue)
LIST_REMOVE(release_resources_queue, u->manager->release_resources_queue, u);
bpf_firewall_close(u);
condition_free_list(u->conditions);
condition_free_list(u->asserts);