netdev - Re: [PATCH net-next 3/6] net: ipv4: use kfree_skb_reason() in ip_rcv_finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADxym3YpyWh59cjtUqxGXxpb2+2Ywb-n4Jpz1KJG3AYRf5cenA@mail.gmail.com>
Date:   Wed, 26 Jan 2022 10:36:41 +0800
From:   Menglong Dong <menglong8.dong@...il.com>
To:     David Ahern <dsahern@...il.com>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>, mingo@...hat.com,
        David Miller <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>, pablo@...filter.org,
        kadlec@...filter.org, Florian Westphal <fw@...len.de>,
        Menglong Dong <imagedong@...cent.com>,
        Eric Dumazet <edumazet@...gle.com>, alobakin@...me,
        paulb@...dia.com, Paolo Abeni <pabeni@...hat.com>,
        talalahmad@...gle.com, haokexin@...il.com,
        Kees Cook <keescook@...omium.org>, memxor@...il.com,
        LKML <linux-kernel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org, Cong Wang <cong.wang@...edance.com>
Subject: Re: [PATCH net-next 3/6] net: ipv4: use kfree_skb_reason() in ip_rcv_finish_core()

On Wed, Jan 26, 2022 at 10:18 AM David Ahern <dsahern@...il.com> wrote:
>
> On 1/24/22 6:15 AM, menglong8.dong@...il.com wrote:
> > diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
> > index ab9bee4bbf0a..77bb9ddc441b 100644
> > --- a/net/ipv4/ip_input.c
> > +++ b/net/ipv4/ip_input.c
> > @@ -318,8 +318,10 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
> >  {
> >       const struct iphdr *iph = ip_hdr(skb);
> >       int (*edemux)(struct sk_buff *skb);
> > +     int err, drop_reason;
> >       struct rtable *rt;
> > -     int err;
> > +
> > +     drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
> >
> >       if (ip_can_use_hint(skb, iph, hint)) {
> >               err = ip_route_use_hint(skb, iph->daddr, iph->saddr, iph->tos,
> > @@ -339,8 +341,10 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
> >               if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) {
> >                       err = INDIRECT_CALL_2(edemux, tcp_v4_early_demux,
> >                                             udp_v4_early_demux, skb);
> > -                     if (unlikely(err))
> > +                     if (unlikely(err)) {
> > +                             drop_reason = SKB_DROP_REASON_EARLY_DEMUX;
>
> is there really value in this one? You ignore the error case from
> ip_route_use_hint which is a similar, highly unlikely error path so why
> care about this one? The only failure case is ip_mc_validate_source from
> udp_v4_early_demux and 'early demux' drops really mean nothing to the user.
>

Ok, let's just ignore it ( In fact, it's because that I don't know
what 'early demux'
do :/ )

>
> >                               goto drop_error;
> > +                     }
> >                       /* must reload iph, skb->head might have changed */
> >                       iph = ip_hdr(skb);
> >               }
> > @@ -353,8 +357,10 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
> >       if (!skb_valid_dst(skb)) {
> >               err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
> >                                          iph->tos, dev);
> > -             if (unlikely(err))
> > +             if (unlikely(err)) {
> > +                     drop_reason = SKB_DROP_REASON_IP_ROUTE_INPUT;
>
> The reason codes should be meaningful to users and not derived from a
> code path. What does SKB_DROP_REASON_IP_ROUTE_INPUT mean as a failure?
>

Is't it meaningful? I name it from the meaning of 'ip route lookup or validate
failed in input path', can't it express this information?

>
> >                       goto drop_error;
> > +             }
> >       }
> >
> >  #ifdef CONFIG_IP_ROUTE_CLASSID