network: ignore -EINVAL from bpf_get_current_comm()
Hopefully fixes #40051.
This commit is contained in:
@@ -2,6 +2,7 @@
|
||||
|
||||
#include "vmlinux.h"
|
||||
|
||||
#include <errno.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
|
||||
#include "sysctl-write-event.h"
|
||||
@@ -104,7 +105,7 @@ int sysctl_monitor(struct bpf_sysctl *ctx) {
|
||||
return 1;
|
||||
|
||||
r = bpf_get_current_comm(we.comm, sizeof(we.comm));
|
||||
if (r < 0) {
|
||||
if (r < 0 && r != -EINVAL) { /* -EINVAL: the process is already vanished */
|
||||
we.errorcode = r;
|
||||
goto send_event;
|
||||
}
|
||||
|
||||
@@ -76,13 +76,13 @@ static int sysctl_event_handler(void *ctx, void *data, size_t data_sz) {
|
||||
log_struct(LOG_WARNING,
|
||||
LOG_MESSAGE_ID(SD_MESSAGE_SYSCTL_CHANGED_STR),
|
||||
LOG_ITEM("OBJECT_PID=" PID_FMT, we->pid),
|
||||
LOG_ITEM("OBJECT_COMM=%s", we->comm),
|
||||
LOG_ITEM("OBJECT_COMM=%s", empty_to_na(we->comm)),
|
||||
LOG_ITEM("SYSCTL=%s", path),
|
||||
LOG_ITEM("OLDVALUE=%s", we->current),
|
||||
LOG_ITEM("NEWVALUE=%s", we->newvalue),
|
||||
LOG_ITEM("OURVALUE=%s", value),
|
||||
LOG_MESSAGE("Foreign process '%s[" PID_FMT "]' changed sysctl '%s' from '%s' to '%s', conflicting with our setting to '%s'.",
|
||||
we->comm, we->pid, path, we->current, we->newvalue, value));
|
||||
empty_to_na(we->comm), we->pid, path, we->current, we->newvalue, value));
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user