[PATCH] bpf: crypto: replace -EEXIST with -EBUSY

[PATCH] bpf: crypto: replace -EEXIST with -EBUSY

[Daniel Gomez]

From: Daniel Gomez <da.gomez@samsung.com>

The -EEXIST error code is reserved by the module loading infrastructure
to indicate that a module is already loaded. When a module's init
function returns -EEXIST, userspace tools like kmod interpret this as
"module already loaded" and treat the operation as successful, returning
0 to the user even though the module initialization actually failed.

This follows the precedent set by commit 54416fd76770 ("netfilter:
conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
issue in nf_conntrack_helper_register().

This affects bpf_crypto_skcipher module. While the configuration
required to build it as a module is unlikely in practice, it is
technically possible, so fix it for correctness.

Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
---
The error code -EEXIST is reserved by the kernel module loader to
indicate that a module with the same name is already loaded. When a
module's init function returns -EEXIST, kmod interprets this as "module
already loaded" and reports success instead of failure [1].

The kernel module loader will include a safety net that provides -EEXIST
to -EBUSY with a warning [2], and a documentation patch has been sent to
prevent future occurrences [3].

These affected code paths were identified using a static analysis tool
[4] that traces -EEXIST returns to module_init(). The tool was developed
with AI assistance and all findings were manually validated.

Link: https://lore.kernel.org/all/aKEVQhJpRdiZSliu@orbyte.nwl.cc/ [1]
Link: https://lore.kernel.org/all/20251013-module-warn-ret-v1-0-ab65b41af01f@intel.com/ [2]
Link: https://lore.kernel.org/all/20251218-dev-module-init-eexists-modules-docs-v1-0-361569aa782a@samsung.com/ [3]
Link: https://gitlab.com/-/snippets/4913469 [4]
---
 kernel/bpf/crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
index 83c4d9943084..1ab79a6dec84 100644
--- a/kernel/bpf/crypto.c
+++ b/kernel/bpf/crypto.c
@@ -60,7 +60,7 @@ struct bpf_crypto_ctx {
 int bpf_crypto_register_type(const struct bpf_crypto_type *type)
 {
 	struct bpf_crypto_type_list *node;
-	int err = -EEXIST;
+	int err = -EBUSY;
 
 	down_write(&bpf_crypto_types_sem);
 	list_for_each_entry(node, &bpf_crypto_types, list) {

---
base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
change-id: 20251219-dev-module-init-eexists-bpf-da2aa3577437

Best regards,
--  
Daniel Gomez <da.gomez@samsung.com>

Re: [PATCH] bpf: crypto: replace -EEXIST with -EBUSY

[Vadim Fedorenko]

On 20/12/2025 03:48, Daniel Gomez wrote:
> From: Daniel Gomez <da.gomez@samsung.com>
> 
> The -EEXIST error code is reserved by the module loading infrastructure
> to indicate that a module is already loaded. When a module's init
> function returns -EEXIST, userspace tools like kmod interpret this as
> "module already loaded" and treat the operation as successful, returning
> 0 to the user even though the module initialization actually failed.
> 
> This follows the precedent set by commit 54416fd76770 ("netfilter:
> conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
> issue in nf_conntrack_helper_register().
> 
> This affects bpf_crypto_skcipher module. While the configuration
> required to build it as a module is unlikely in practice, it is
> technically possible, so fix it for correctness.
> 
> Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
> ---
> The error code -EEXIST is reserved by the kernel module loader to
> indicate that a module with the same name is already loaded. When a
> module's init function returns -EEXIST, kmod interprets this as "module
> already loaded" and reports success instead of failure [1].
> 
> The kernel module loader will include a safety net that provides -EEXIST
> to -EBUSY with a warning [2], and a documentation patch has been sent to
> prevent future occurrences [3].
> 
> These affected code paths were identified using a static analysis tool
> [4] that traces -EEXIST returns to module_init(). The tool was developed
> with AI assistance and all findings were manually validated.
> 
> Link: https://lore.kernel.org/all/aKEVQhJpRdiZSliu@orbyte.nwl.cc/ [1]
> Link: https://lore.kernel.org/all/20251013-module-warn-ret-v1-0-ab65b41af01f@intel.com/ [2]
> Link: https://lore.kernel.org/all/20251218-dev-module-init-eexists-modules-docs-v1-0-361569aa782a@samsung.com/ [3]
> Link: https://gitlab.com/-/snippets/4913469 [4]

Even though I'm not quite sure that we should care once the core
module loader can adjust the error, the change looks ok to me:

Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

Re: [PATCH] bpf: crypto: replace -EEXIST with -EBUSY

[Alexei Starovoitov]

On Sat, Dec 20, 2025 at 8:55 AM Vadim Fedorenko
<vadim.fedorenko@linux.dev> wrote:
>
> On 20/12/2025 03:48, Daniel Gomez wrote:
> > From: Daniel Gomez <da.gomez@samsung.com>
> >
> > The -EEXIST error code is reserved by the module loading infrastructure
> > to indicate that a module is already loaded. When a module's init
> > function returns -EEXIST, userspace tools like kmod interpret this as
> > "module already loaded" and treat the operation as successful, returning
> > 0 to the user even though the module initialization actually failed.
> >
> > This follows the precedent set by commit 54416fd76770 ("netfilter:
> > conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
> > issue in nf_conntrack_helper_register().
> >
> > This affects bpf_crypto_skcipher module. While the configuration
> > required to build it as a module is unlikely in practice, it is
> > technically possible, so fix it for correctness.
> >
> > Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
> > ---
> > The error code -EEXIST is reserved by the kernel module loader to
> > indicate that a module with the same name is already loaded. When a
> > module's init function returns -EEXIST, kmod interprets this as "module
> > already loaded" and reports success instead of failure [1].
> >
> > The kernel module loader will include a safety net that provides -EEXIST
> > to -EBUSY with a warning [2], and a documentation patch has been sent to
> > prevent future occurrences [3].
> >
> > These affected code paths were identified using a static analysis tool
> > [4] that traces -EEXIST returns to module_init(). The tool was developed
> > with AI assistance and all findings were manually validated.
> >
> > Link: https://lore.kernel.org/all/aKEVQhJpRdiZSliu@orbyte.nwl.cc/ [1]
> > Link: https://lore.kernel.org/all/20251013-module-warn-ret-v1-0-ab65b41af01f@intel.com/ [2]
> > Link: https://lore.kernel.org/all/20251218-dev-module-init-eexists-modules-docs-v1-0-361569aa782a@samsung.com/ [3]
> > Link: https://gitlab.com/-/snippets/4913469 [4]
>
> Even though I'm not quite sure that we should care once the core
> module loader can adjust the error, the change looks ok to me:
>
> Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

Applied to bpf-next.