linux-kernel - Re: [PATCH v3 net-next] net-core: add rx_otherhost

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Mar 2022 15:18:25 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     David Ahern <dsahern@...nel.org>
Cc:     Jeffrey Ji <jeffreyjilinux@...il.com>,
        "David S . Miller" <davem@...emloft.net>,
        Brian Vazquez <brianvv@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Antoine Tenart <atenart@...nel.org>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Alexander Lobakin <alexandr.lobakin@...el.com>,
        Kumar Kartikeya Dwivedi <memxor@...il.com>,
        Arnd Bergmann <arnd@...db.de>, netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        jeffreyji <jeffreyji@...gle.com>
Subject: Re: [PATCH v3 net-next] net-core: add rx_otherhost_dropped counter

On Tue, Mar 8, 2022 at 2:51 PM David Ahern <dsahern@...nel.org> wrote:
>
> On 3/8/22 2:25 PM, Jeffrey Ji wrote:
> > diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
> > index 95f7bb052784..8b87ea99904b 100644
> > --- a/net/ipv4/ip_input.c
> > +++ b/net/ipv4/ip_input.c
> > @@ -451,6 +451,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
> >        * that it receives, do not try to analyse it.
> >        */
> >       if (skb->pkt_type == PACKET_OTHERHOST) {
> > +             atomic_long_inc(&skb->dev->rx_otherhost_dropped);
> >               drop_reason = SKB_DROP_REASON_OTHERHOST;
> >               goto drop;
> >       }
> > diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
> > index 5b5ea35635f9..5624c937f87f 100644
> > --- a/net/ipv6/ip6_input.c
> > +++ b/net/ipv6/ip6_input.c
> > @@ -150,6 +150,7 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
> >       struct inet6_dev *idev;
> >
> >       if (skb->pkt_type == PACKET_OTHERHOST) {
> > +             atomic_long_inc(&skb->dev->rx_otherhost_dropped);
> >               kfree_skb(skb);
> >               return NULL;
> >       }
>
> that's an expensive packet counter for a common path (e.g., hosting
> environments).

This was the reason for the initial patch, using SNMP stat, being per cpu.

Adding per-device per-cpu data for this counter will increase cost of
netdevice dismantle phase,
and increase time for ndo_get_stats64(), especially on hosts with 256
or 512 cpus.