netdev - Re: [PATCH net-next v3] net: introduce per netns packet chains

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9wuVAyFYcziY4-D@krikkit>
Date: Thu, 20 Mar 2025 16:03:48 +0100
From: Sabrina Dubroca <sd@...asysnail.net>
To: Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org, Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Simon Horman <horms@...nel.org>
Subject: Re: [PATCH net-next v3] net: introduce per netns packet chains

2025-03-19, 17:24:03 +0100, Paolo Abeni wrote:
> Currently network taps unbound to any interface are linked in the
> global ptype_all list, affecting the performance in all the network
> namespaces.
> 
> Add per netns ptypes chains, so that in the mentioned case only
> the netns owning the packet socket(s) is affected.
> 
> While at that drop the global ptype_all list: no in kernel user
> registers a tap on "any" type without specifying either the target
> device or the target namespace (and IMHO doing that would not make
> any sense).
> 
> Note that this adds a conditional in the fast path (to check for
> per netns ptype_specific list) and increases the dataset size by
> a cacheline (owing the per netns lists).
> 
> Signed-off-by: Paolo Abeni <pabeni@...hat.com>

Reviewed-by: Sabrina Dubroca <sd@...asysnail.net>


Just two tiny nits:


>  /**
> - * dev_nit_active - return true if any network interface taps are in use
> + * dev_nit_active_rcu - return true if any network interface taps are in use
> + *
> + * The caller must hold the RCU lock
>   *
>   * @dev: network device to check for the presence of taps
>   */
> -bool dev_nit_active(struct net_device *dev)
> +bool dev_nit_active_rcu(struct net_device *dev)

I guess that would have been a good time to make dev const? (same in
the new wrapper)

>  {
> -	return !list_empty(&net_hotdata.ptype_all) ||
> +	/* Callers may hold either RCU or RCU BH lock */
> +	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
> +
> +	return !list_empty(&dev_net(dev)->ptype_all) ||
>  	       !list_empty(&dev->ptype_all);
>  }

[...]
> @@ -5830,6 +5851,14 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
>  		deliver_ptype_list_skb(skb, &pt_prev, orig_dev, type,
>  				       &ptype_base[ntohs(type) &
>  						   PTYPE_HASH_MASK]);
> +
> +		/* orig_dev and skb->dev could belong to different netns;
> +		 * Even is such case we need to traverse only the list

I think there's a typo here: "Even in"

-- 
Sabrina