netdev - Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260129155446.4ad21f1e@kernel.org>
Date: Thu, 29 Jan 2026 15:54:46 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: Gal Pressman <gal@...dia.com>
Cc: davem@...emloft.net, netdev@...r.kernel.org, edumazet@...gle.com,
 pabeni@...hat.com, andrew+netdev@...n.ch, horms@...nel.org, ast@...nel.org,
 daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev,
 eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org, dsahern@...il.com, bpf@...r.kernel.org
Subject: Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

On Thu, 29 Jan 2026 09:45:10 +0200 Gal Pressman wrote:
> On 28/01/2026 18:10, Jakub Kicinski wrote:
> > Gal reports that BPF redirect increments dev->stats.tx_errors
> > on failure. This is not correct, most modern drivers completely
> > ignore dev->stats so these drops will be invisible to the user.
> > Core code should use the dedicated core stats which are folded
> > into device stats in dev_get_stats().
> > 
> > Reported-by: Gal Pressman <gal@...dia.com>
> > Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com
> > Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
> > Signed-off-by: Jakub Kicinski <kuba@...nel.org>  
> 
> Aha, this kinda makes my mlx5 fix redundant.
> I'm debating whether I should send a revert?

Up to you, it doesn't hurt.
I guess the main reason to revert would be to catch similar bugs 
in the future, given the popularity of mlx5, but up to you if
you want to be exposed to such bugs :)

> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 616e0520a0bb..2c21735798a5 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -2289,12 +2289,12 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
> >  
> >  	err = bpf_out_neigh_v6(net, skb, dev, nh);
> >  	if (unlikely(net_xmit_eval(err)))
> > -		DEV_STATS_INC(dev, tx_errors);
> > +		dev_core_stats_tx_dropped_inc(dev);  
> 
> The commit message didn't mention anything about changing tx_errors to
> tx_dropped.

Fair, let me respin with a note.