On Mon, Sep 09, 2024 at 06:15:48PM +0200, hsimeliere.opensource@xxxxxxxxxxx wrote: > From: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > > commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde upstream. > > When using a BPF program on kernel_connect(), the call can return -EPERM. This > causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing > the kernel to potentially freeze up. > > Neil suggested: > > This will propagate -EPERM up into other layers which might not be ready > to handle it. It might be safer to map EPERM to an error we would be more > likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. > > ECONNREFUSED as error seems reasonable. For programs setting a different error > can be out of reach (see handling in 4fbac77d2d09) in particular on kernels > which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err > instead of allow boolean"), thus given that it is better to simply remap for > consistent behavior. UDP does handle EPERM in xs_udp_send_request(). > > Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") > Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") > Co-developed-by: Lex Siegel <usiegl00@xxxxxxxxx> > Signed-off-by: Lex Siegel <usiegl00@xxxxxxxxx> > Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > Cc: Neil Brown <neilb@xxxxxxx> > Cc: Trond Myklebust <trondmy@xxxxxxxxxx> > Cc: Anna Schumaker <anna@xxxxxxxxxx> > Link: https://github.com/cilium/cilium/issues/33395 > Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@xxxxxxxxxxxxxxxxxxxxx > Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.1720075070.git.daniel@xxxxxxxxxxxxx > Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx> > Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@xxxxxxxxxxx> > --- > net/sunrpc/xprtsock.c | 7 +++++++ > 1 file changed, 7 insertions(+) Now queued up, thanks. greg k-h