From: Greg Kroah-Hartman Date: Tue, 10 Sep 2024 08:38:14 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.19.322~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=98821bcdc0dcb67fe7a978727d1dc9b2071fa3a4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch --- diff --git a/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch b/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch new file mode 100644 index 00000000000..9d8c6b4455c --- /dev/null +++ b/queue-4.19/net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch @@ -0,0 +1,59 @@ +From 626dfed5fa3bfb41e0dffd796032b555b69f9cde Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Thu, 4 Jul 2024 08:41:57 +0200 +Subject: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket + +From: Daniel Borkmann + +commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde upstream. + +When using a BPF program on kernel_connect(), the call can return -EPERM. This +causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing +the kernel to potentially freeze up. + +Neil suggested: + + This will propagate -EPERM up into other layers which might not be ready + to handle it. It might be safer to map EPERM to an error we would be more + likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. + +ECONNREFUSED as error seems reasonable. For programs setting a different error +can be out of reach (see handling in 4fbac77d2d09) in particular on kernels +which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err +instead of allow boolean"), thus given that it is better to simply remap for +consistent behavior. UDP does handle EPERM in xs_udp_send_request(). + +Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") +Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") +Co-developed-by: Lex Siegel +Signed-off-by: Lex Siegel +Signed-off-by: Daniel Borkmann +Cc: Neil Brown +Cc: Trond Myklebust +Cc: Anna Schumaker +Link: https://github.com/cilium/cilium/issues/33395 +Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.neil.brown.name +Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.1720075070.git.daniel@iogearbox.net +Signed-off-by: Paolo Abeni +Signed-off-by: Hugo SIMELIERE +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/xprtsock.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2466,6 +2466,13 @@ static void xs_tcp_setup_socket(struct w + case -EALREADY: + xprt_unlock_connect(xprt, transport); + return; ++ case -EPERM: ++ /* Happens, for instance, if a BPF program is preventing ++ * the connect. Remap the error so upper layers can better ++ * deal with it. ++ */ ++ status = -ECONNREFUSED; ++ /* fall through */ + case -EINVAL: + /* Happens, for instance, if the user specified a link + * local IPv6 address without a scope-id. diff --git a/queue-4.19/series b/queue-4.19/series index 80847d69466..882a66800a6 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -90,3 +90,4 @@ acpi-processor-fix-memory-leaks-in-error-paths-of-pr.patch drm-i915-fence-mark-debug_fence_init_onstack-with-__.patch drm-i915-fence-mark-debug_fence_free-with-__maybe_un.patch rtmutex-drop-rt_mutex-wait_lock-before-scheduling.patch +net-sunrpc-remap-eperm-in-case-of-connection-failure-in-xs_tcp_setup_socket.patch