netdev - Re: [PATCH net-next 1/3] net: ip: add skb drop reasons for ip egress path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Feb 2022 20:13:46 -0700
From:   David Ahern <dsahern@...nel.org>
To:     menglong8.dong@...il.com, kuba@...nel.org
Cc:     rostedt@...dmis.org, mingo@...hat.com, davem@...emloft.net,
        yoshfuji@...ux-ipv6.org, imagedong@...cent.com,
        edumazet@...gle.com, alobakin@...me, cong.wang@...edance.com,
        paulb@...dia.com, talalahmad@...gle.com, keescook@...omium.org,
        ilias.apalodimas@...aro.org, memxor@...il.com,
        flyingpeng@...cent.com, mengensun@...cent.com,
        daniel@...earbox.net, yajun.deng@...ux.dev, roopa@...dia.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 1/3] net: ip: add skb drop reasons for ip egress
 path

On 2/20/22 8:57 AM, menglong8.dong@...il.com wrote:
> From: Menglong Dong <imagedong@...cent.com>
> 
> Replace kfree_skb() with kfree_skb_reason() in the packet egress path of
> IP layer (both IPv4 and IPv6 are considered).
> 
> Following functions are involved:
> 
> __ip_queue_xmit()
> ip_finish_output()
> ip_mc_finish_output()
> ip6_output()
> ip6_finish_output()
> ip6_finish_output2()
> 
> Following new drop reasons are introduced:
> 
> SKB_DROP_REASON_IP_OUTNOROUTES
> SKB_DROP_REASON_BPF_CGROUP_EGRESS
> SKB_DROP_REASON_IPV6DSIABLED
> 
> Reviewed-by: Mengen Sun <mengensun@...cent.com>
> Reviewed-by: Hao Peng <flyingpeng@...cent.com>
> Signed-off-by: Menglong Dong <imagedong@...cent.com>
> ---
>  include/linux/skbuff.h     | 13 +++++++++++++
>  include/trace/events/skb.h |  4 ++++
>  net/ipv4/ip_output.c       |  6 +++---
>  net/ipv6/ip6_output.c      |  6 +++---
>  4 files changed, 23 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index a3e90efe6586..c310a4a8fc86 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -380,6 +380,19 @@ enum skb_drop_reason {
>  					 * the ofo queue, corresponding to
>  					 * LINUX_MIB_TCPOFOMERGE
>  					 */
> +	SKB_DROP_REASON_IP_OUTNOROUTES,	/* route lookup failed during
> +					 * packet outputting
> +					 */

This should be good enough since the name contains OUT.

/* route lookup failed */

> +	SKB_DROP_REASON_BPF_CGROUP_EGRESS,	/* dropped by eBPF program
> +						 * with type of BPF_PROG_TYPE_CGROUP_SKB
> +						 * and attach type of
> +						 * BPF_CGROUP_INET_EGRESS
> +						 * during packet sending
> +						 */

/* dropped by BPF_CGROUP_INET_EGRESS eBPF program */

> +	SKB_DROP_REASON_IPV6DSIABLED,	/* IPv6 is disabled on the device,
> +					 * see the doc for disable_ipv6
> +					 * in ip-sysctl.rst for detail
> +					 */

Just /* IPv6 is disabled on the device */


>  	SKB_DROP_REASON_MAX,
>  };
>  

> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index 0c0574eb5f5b..df549b7415fb 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c

This file has other relevant drops. e.g., ip_finish_output2 when a neigh
entry can not be created and after skb_gso_segment. The other set for
tun/tap devices has SKB_DROP_REASON_SKB_GSO_SEG which can be used for
the latter. That set also adds kfree_skb_list_reason for the frag drops.


> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 0c6c971ce0a5..4cd9e5fd25e4 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c

Similarly here. The other set should land in the next few days, so you
cna put this set on top of it.