[PATCH iproute2 10/11] ss: keep following events after ENOBUFS

[Stephen Hemminger <stephen@networkplumber.org>]

ss -E exited when a burst of socket closes overflowed its receive
queue. Lost events are not fatal, so keep listening, as
rtnl_listen() does.

With -K the second socket, used only to send SOCK_DESTROY, also
joined the event groups and its queue filled up unread. Open it
without groups.

Reported-by: Anthropic OSS scanner (ANT-2026-39AYDLBX)
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 misc/ss.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 2f7c891a..55d9ae00 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -5089,14 +5089,19 @@ static int handle_follow_request(struct filter *f)
 	rth.local.nl_pid = 0;
 
 	if (f->kill) {
-		if (rtnl_open_byproto(&rth2, groups, NETLINK_SOCK_DIAG)) {
+		/* Only used to send SOCK_DESTROY, must not get the events */
+		if (rtnl_open_byproto(&rth2, 0, NETLINK_SOCK_DIAG)) {
 			rtnl_close(&rth);
 			return -1;
 		}
 		f->rth_for_killing = &rth2;
 	}
 
-	if (rtnl_dump_filter(&rth, generic_show_sock, f))
+	/* ENOBUFS means events were lost, keep listening */
+	do {
+		ret = rtnl_dump_filter(&rth, generic_show_sock, f);
+	} while (ret == -ENOBUFS);
+	if (ret)
 		ret = -1;
 
 	rtnl_close(&rth);
-- 
2.53.0