Re: [PATCH] netfilter: replace -EEXIST with -EBUSY

[Daniel Gomez]

On 19/12/2025 08.48, Florian Westphal wrote:
> Daniel Gomez <da.gomez@xxxxxxxxxx> wrote:
>> From: Daniel Gomez <da.gomez@xxxxxxxxxxx>
>>
>> The -EEXIST error code is reserved by the module loading infrastructure
>> to indicate that a module is already loaded. When a module's init
>> function returns -EEXIST, userspace tools like kmod interpret this as
>> "module already loaded" and treat the operation as successful, returning
>> 0 to the user even though the module initialization actually failed.
>>
>> This follows the precedent set by commit 54416fd76770 ("netfilter:
>> conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
>> issue in nf_conntrack_helper_register().
>>
>> Affected modules:
>>   * ebtable_broute ebtable_filter ebtable_nat arptable_filter
>>   * ip6table_filter ip6table_mangle ip6table_nat ip6table_raw
>>   * ip6table_security iptable_filter iptable_mangle iptable_nat
>>   * iptable_raw iptable_security
> 
> But this is very different from what 54416fd76770 fixes.
> 
> Before 54416fd76770. userspace can make a configuration entry that
> prevents and unrelated module from getting loaded but at the same time
> it doesn't provide any error to userspace.
> 
> All these -EEXIST should not be possible unless the module is
> already loaded.

I see.

> I'll apply this patch but its not related to 54416fd76770 afaics.

Thanks.

Then, what about removing that paragraph that mentions the commit and add
something like:

Replace -EEXIST with -EBUSY to ensure correct error reporting in the module
initialization path.