4.19-stable patches

added patches:
	net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch

diff --git a/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch b/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch
new file mode 100644 (file)
index 0000000..9d8c6b4
--- /dev/null
+++ b/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch
@@ -0,0 +1,59 @@
+From 626dfed5fa3bfb41e0dffd796032b555b69f9cde Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 4 Jul 2024 08:41:57 +0200
+Subject: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde upstream.
+
+When using a BPF program on kernel_connect(), the call can return -EPERM. This
+causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing
+the kernel to potentially freeze up.
+
+Neil suggested:
+
+  This will propagate -EPERM up into other layers which might not be ready
+  to handle it. It might be safer to map EPERM to an error we would be more
+  likely to expect from the network system - such as ECONNREFUSED or ENETDOWN.
+
+ECONNREFUSED as error seems reasonable. For programs setting a different error
+can be out of reach (see handling in 4fbac77d2d09) in particular on kernels
+which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err
+instead of allow boolean"), thus given that it is better to simply remap for
+consistent behavior. UDP does handle EPERM in xs_udp_send_request().
+
+Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect")
+Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind")
+Co-developed-by: Lex Siegel <usiegl00@gmail.com>
+Signed-off-by: Lex Siegel <usiegl00@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Neil Brown <neilb@suse.de>
+Cc: Trond Myklebust <trondmy@kernel.org>
+Cc: Anna Schumaker <anna@kernel.org>
+Link: https://github.com/cilium/cilium/issues/33395
+Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.neil.brown.name
+Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.1720075070.git.daniel@iogearbox.net
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xprtsock.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2466,6 +2466,13 @@ static void xs_tcp_setup_socket(struct w
+       case -EALREADY:
+               xprt_unlock_connect(xprt, transport);
+               return;
++      case -EPERM:
++              /* Happens, for instance, if a BPF program is preventing
++               * the connect. Remap the error so upper layers can better
++               * deal with it.
++               */
++              status = -ECONNREFUSED;
++              /* fall through */
+       case -EINVAL:
+               /* Happens, for instance, if the user specified a link
+                * local IPv6 address without a scope-id.

diff --git a/queue-4.19/series b/queue-4.19/series
index 80847d694665fbc4e30cd67124e5e773f5373cf7..882a66800a635d3f51fedff2dd4b4db9a451722b 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -90,3 +90,4 @@ acpi-processor-fix-memory-leaks-in-error-paths-of-pr.patch
 drm-i915-fence-mark-debug_fence_init_onstack-with-__.patch
 drm-i915-fence-mark-debug_fence_free-with-__maybe_un.patch
 rtmutex-drop-rt_mutex-wait_lock-before-scheduling.patch
+net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch