linux-kernel - Re: [PATCH v4 net-next 1/7] net: add rx_sk to trace_kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 14 Jun 2024 12:15:36 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Jesper Dangaard Brouer <hawk@...nel.org>, Yan Zhai <yan@...udflare.com>,
  netdev@...r.kernel.org
Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
 <edumazet@...gle.com>,  Jakub Kicinski <kuba@...nel.org>, Simon Horman
 <horms@...nel.org>, David Ahern <dsahern@...nel.org>, Abhishek Chauhan
 <quic_abchauha@...cinc.com>, Mina Almasry <almasrymina@...gle.com>, Florian
 Westphal <fw@...len.de>, Alexander Lobakin <aleksander.lobakin@...el.com>,
 David Howells <dhowells@...hat.com>, Jiri Pirko <jiri@...nulli.us>, Daniel
 Borkmann <daniel@...earbox.net>, Sebastian Andrzej Siewior
 <bigeasy@...utronix.de>, Lorenzo Bianconi <lorenzo@...nel.org>, Pavel
 Begunkov <asml.silence@...il.com>, linux-kernel@...r.kernel.org, 
 kernel-team@...udflare.com, Steven Rostedt <rostedt@...dmis.org>, Masami
 Hiramatsu <mhiramat@...nel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, Neil Horman <nhorman@...driver.com>,
 linux-trace-kernel@...r.kernel.org, Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH v4 net-next 1/7] net: add rx_sk to trace_kfree_skb

On Wed, 2024-06-12 at 09:59 +0200, Jesper Dangaard Brouer wrote:
> 
> On 11/06/2024 22.11, Yan Zhai wrote:
> > skb does not include enough information to find out receiving
> > sockets/services and netns/containers on packet drops. In theory
> > skb->dev tells about netns, but it can get cleared/reused, e.g. by TCP
> > stack for OOO packet lookup. Similarly, skb->sk often identifies a local
> > sender, and tells nothing about a receiver.
> > 
> > Allow passing an extra receiving socket to the tracepoint to improve
> > the visibility on receiving drops.
> > 
> > Signed-off-by: Yan Zhai<yan@...udflare.com>
> > ---
> > v3->v4: adjusted the TP_STRUCT field order to be consistent
> > v2->v3: fixed drop_monitor function prototype
> > ---
> >   include/trace/events/skb.h | 11 +++++++----
> >   net/core/dev.c             |  2 +-
> >   net/core/drop_monitor.c    |  9 ++++++---
> >   net/core/skbuff.c          |  2 +-
> >   4 files changed, 15 insertions(+), 9 deletions(-)
> > 
> > diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
> > index 07e0715628ec..3e9ea1cca6f2 100644
> > --- a/include/trace/events/skb.h
> > +++ b/include/trace/events/skb.h
> > @@ -24,13 +24,14 @@ DEFINE_DROP_REASON(FN, FN)
> >   TRACE_EVENT(kfree_skb,
> >   
> >   	TP_PROTO(struct sk_buff *skb, void *location,
> > -		 enum skb_drop_reason reason),
> > +		 enum skb_drop_reason reason, struct sock *rx_sk),
> >   
> > -	TP_ARGS(skb, location, reason),
> > +	TP_ARGS(skb, location, reason, rx_sk),
> >   
> >   	TP_STRUCT__entry(
> >   		__field(void *,		skbaddr)
> >   		__field(void *,		location)
> > +		__field(void *,		rx_skaddr)
> 
> Is there any reason for appending the "addr" part to "rx_sk" ?
> It makes it harder to read this is the sk (socket).
> 
> AFAICR the skbaddr naming is a legacy thing.

I'm double-minded about the above: I can see your point, but on the
flip side the 'addr' suffix is consistently used in net-related
tracepoints.
> 
> >   		__field(unsigned short,	protocol)
> >   		__field(enum skb_drop_reason,	reason)
> >   	),
> > @@ -38,12 +39,14 @@ TRACE_EVENT(kfree_skb,
> >   	TP_fast_assign(
> >   		__entry->skbaddr = skb;
> >   		__entry->location = location;
> > +		__entry->rx_skaddr = rx_sk;
> >   		__entry->protocol = ntohs(skb->protocol);
> >   		__entry->reason = reason;
> >   	),
> >   
> > -	TP_printk("skbaddr=%p protocol=%u location=%pS reason: %s",
> > -		  __entry->skbaddr, __entry->protocol, __entry->location,
> > +	TP_printk("skbaddr=%p rx_skaddr=%p protocol=%u location=%pS reason: %s",
>                                ^^^^^^^^^
> I find it hard to visually tell skbaddr and rx_skaddr apart.
> And especially noticing the "skb" vs "sk" part of the string.

I agree 'rx_skaddr' is sub-optimal. Either be consistent with all the
other net tracepoints and use 'skaddr' (which will very likely will
increase Jesper concerns, but I personally have no problem with such
format) or prefer readability with something alike 'rx_sk' or (even
better) 'sk'.

Thanks,

Paolo