net: pass receive socket to drop tracepoint

Greeting!

We set up our production packet drop monitoring around the kfree_skb tracepoint. While this tracepoint is extremely valuable for diagnosing critical problems, we find some limitation with drops on the local receive path: this tracepoint can only inspect the dropped skb itself, but such skb might not carry enough information to:

1. determine in which netns/container this skb gets dropped
2. determine by which socket/service this skb oughts to be received

The 1st issue is because skb->dev is the only member field with valid netns reference. But skb->dev can get cleared or reused. For example, tcp_v4_rcv will clear skb->dev and in later processing it might be reused for OFO tree.

The 2nd issue is because there is no reference on an skb that reliably points to a receiving socket. skb->sk usually points to the local sending socket, and it only points to a receive socket briefly after early demux stage, yet the socket can get stolen later. For certain drop reason like TCP OFO_MERGE, Zerowindow, UDP at PROTO_MEM error, etc, it is hard to infer which receiving socket is impacted. This cannot be overcome by simply looking at the packet header, because of complications like sk lookup programs. In the past, single purpose tracepoints like trace_udp_fail_queue_rcv_skb, trace_sock_rcvqueue_full, etc are added as needed to provide more visibility. This could be handled in a more generic way.

In this change set we propose a new 'kfree_skb_for_sk' call as a drop-in replacement for kfree_skb_reason at various local input path. It accepts an extra receiving socket argument, and places the socket in skb->cb for tracepoint consumption. With an rx socket, it can easily deal with both issues above. Using cb field is more of a concern that a tracepoint signature might be a part of stable ABI, but please advise if otherwise.

Yan Zhai (6):
net: add kfree_skb_for_sk function
ping: pass rx socket on rcv drops
net: raw: pass rx socket on rcv drops
tcp: pass rx socket on rcv drops
udp: pass rx socket on rcv drops
af_packet: pass rx socket on rcv drops

 include/linux/skbuff.h | 48 ++++++++++++++++++++++++++++++++++++++++--
 net/core/dev.c         | 21 +++++++-----------
 net/core/skbuff.c      | 29 +++++++++++++------------
 net/ipv4/ping.c        |  2 +-
 net/ipv4/raw.c         |  4 ++--
 net/ipv4/syncookies.c  |  2 +-
 net/ipv4/tcp_input.c   |  2 +-
 net/ipv4/tcp_ipv4.c    |  4 ++--
 net/ipv4/udp.c         |  6 +++---
 net/ipv6/raw.c         |  8 +++----
 net/ipv6/syncookies.c  |  2 +-
 net/ipv6/tcp_ipv6.c    |  4 ++--
 net/ipv6/udp.c         |  6 +++---
 net/packet/af_packet.c |  6 +++---
 14 files changed, 93 insertions(+), 51 deletions(-)

2.30.2

Implement a new kfree_skb_for_sk to replace kfree_skb_reason on a few local receive path. The function accepts an extra receiving socket argument, which will be set in skb->cb for kfree_skb/consume_skb tracepoint consumption. With this extra bit of information, it will be easier to attribute dropped packets to netns/containers and sockets/services for performance and error monitoring purpose.

---
 include/linux/skbuff.h | 48 ++++++++++++++++++++++++++++++++++++++++--
 net/core/dev.c         | 21 +++++++-----------
 net/core/skbuff.c      | 29 +++++++++++++------------
 3 files changed, 70 insertions(+), 28 deletions(-)

index fe7d8dbef77e..66f5b06798f2 100644
@@ -1251,8 +1251,52 @@ static inline bool skb_data_unref(const struct sk_buff *skb,
 	return true;
 }
 
-void __fix_address
-kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason);
+/*
+ * Some protocol will clear or reuse skb->dev field for other purposes.  For
+ * example, TCP stack would reuse the pointer for out of order packet handling.
+ * This caused some problem for drop monitoring on kfree_skb tracepoint, since
+ * no other fields of an skb provides netns information.  In addition, it is
+ * also complicated to recover receive socket information for dropped packets,
+ * because the socket lookup can be an sk-lookup BPF program.
+ *
+ * This can be addressed by just passing the rx socket to the tracepoint,
+ * because it also has valid netns binding.
+ */
+struct kfree_skb_cb {
+	enum skb_drop_reason reason; /* used only by dev_kfree_skb_irq */
+	struct sock *rx_sk;
+};
+
+#define KFREE_SKB_CB(skb) ((struct kfree_skb_cb *)(skb)->cb)
+
+/* Save cb->rx_sk before calling kfree_skb/consume_skb tracepoint, and restore
+ * after the tracepoint. This is necessary because some skb destructor might
+ * rely on values in skb->cb, e.g. unix_destruct_scm.
+ */
+#define _call_trace_kfree_skb(action, skb, sk, ...)	do {	\
+	if (trace_##action##_skb_enabled()) {			\
+		struct kfree_skb_cb saved;			\
+		saved.rx_sk = KFREE_SKB_CB(skb)->rx_sk;		\
+		KFREE_SKB_CB(skb)->rx_sk = sk;			\
+		trace_##action##_skb((skb), ## __VA_ARGS__);	\
+		KFREE_SKB_CB(skb)->rx_sk = saved.rx_sk;		\
+	}							\
+} while (0)
+
+#define call_trace_kfree_skb(skb, sk, ...) \
+	_call_trace_kfree_skb(kfree, skb, sk, ## __VA_ARGS__)
+
+#define call_trace_consume_skb(skb, sk, ...) \
+	_call_trace_kfree_skb(consume, skb, sk, ## __VA_ARGS__)
+
+void __fix_address kfree_skb_for_sk(struct sk_buff *skb, struct sock *rx_sk,
+				    enum skb_drop_reason reason);
+
+static inline void
+kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason)
+{
+	kfree_skb_for_sk(skb, NULL, reason);
+}
 
 /**
  *	kfree_skb - free an sk_buff with 'NOT_SPECIFIED' reason

index 85fe8138f3e4..17516f26be92 100644
@@ -3135,15 +3135,6 @@ void __netif_schedule(struct Qdisc *q)
 }
 EXPORT_SYMBOL(__netif_schedule);
 
-struct dev_kfree_skb_cb {
-	enum skb_drop_reason reason;
-};
-
-static struct dev_kfree_skb_cb *get_kfree_skb_cb(const struct sk_buff *skb)
-{
-	return (struct dev_kfree_skb_cb *)skb->cb;
-}
-
 void netif_schedule_queue(struct netdev_queue *txq)
 {
 	rcu_read_lock();

@@ -3182,7 +3173,11 @@ void dev_kfree_skb_irq_reason(struct sk_buff *skb, enum skb_drop_reason reason)
 	} else if (likely(!refcount_dec_and_test(&skb->users))) {
 		return;
 	}
-	get_kfree_skb_cb(skb)->reason = reason;
+
+	/* There is no need to save the old cb since we are the only user. */
+	KFREE_SKB_CB(skb)->reason = reason;
+	KFREE_SKB_CB(skb)->rx_sk = NULL;
+
 	local_irq_save(flags);
 	skb->next = __this_cpu_read(softnet_data.completion_queue);
 	__this_cpu_write(softnet_data.completion_queue, skb);

@@ -5229,17 +5224,17 @@ static __latent_entropy void net_tx_action(struct softirq_action *h)
 			clist = clist->next;
 
 			WARN_ON(refcount_read(&skb->users));
-			if (likely(get_kfree_skb_cb(skb)->reason == SKB_CONSUMED))
+			if (likely(KFREE_SKB_CB(skb)->reason == SKB_CONSUMED))
 				trace_consume_skb(skb, net_tx_action);
 			else
 				trace_kfree_skb(skb, net_tx_action,
-						get_kfree_skb_cb(skb)->reason);
+						KFREE_SKB_CB(skb)->reason);
 
 			if (skb->fclone != SKB_FCLONE_UNAVAILABLE)
 				__kfree_skb(skb);
 			else
 				__napi_kfree_skb(skb,
-						 get_kfree_skb_cb(skb)->reason);
+						 KFREE_SKB_CB(skb)->reason);
 		}
 	}
 

index 466999a7515e..5ce6996512a1 100644
@@ -1190,7 +1190,8 @@ void __kfree_skb(struct sk_buff *skb)
 EXPORT_SYMBOL(__kfree_skb);
 
 static __always_inline
-bool __kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason)
+bool __kfree_skb_reason(struct sk_buff *skb, struct sock *rx_sk,
+			enum skb_drop_reason reason)
 {
 	if (unlikely(!skb_unref(skb)))
 		return false;

@@ -1201,28 +1202,30 @@ bool __kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason)
 				SKB_DROP_REASON_SUBSYS_NUM);
 
 	if (reason == SKB_CONSUMED)
-		trace_consume_skb(skb, __builtin_return_address(0));
+		call_trace_consume_skb(skb, rx_sk, __builtin_return_address(0));
 	else
-		trace_kfree_skb(skb, __builtin_return_address(0), reason);
+		call_trace_kfree_skb(skb, rx_sk, __builtin_return_address(0), reason);
+
 	return true;
 }
 
 /**
- *	kfree_skb_reason - free an sk_buff with special reason
+ *	kfree_skb_for_sk - free an sk_buff with special reason and receiving socket
  *	@skb: buffer to free
+ *	@rx_sk: the socket to receive the buffer, or NULL if not applicable
  *	@reason: reason why this skb is dropped
  *
  *	Drop a reference to the buffer and free it if the usage count has
- *	hit zero. Meanwhile, pass the drop reason to 'kfree_skb'
+ *	hit zero. Meanwhile, pass the drop reason and rx socket to 'kfree_skb'
  *	tracepoint.
  */
-void __fix_address
-kfree_skb_reason(struct sk_buff *skb, enum skb_drop_reason reason)
+void __fix_address kfree_skb_for_sk(struct sk_buff *skb, struct sock *rx_sk,
+				    enum skb_drop_reason reason)
 {
-	if (__kfree_skb_reason(skb, reason))
+	if (__kfree_skb_reason(skb, rx_sk, reason))
 		__kfree_skb(skb);
 }
-EXPORT_SYMBOL(kfree_skb_reason);
+EXPORT_SYMBOL(kfree_skb_for_sk);
 
 #define KFREE_SKB_BULK_SIZE	16
 

@@ -1261,7 +1264,7 @@ kfree_skb_list_reason(struct sk_buff *segs, enum skb_drop_reason reason)
 	while (segs) {
 		struct sk_buff *next = segs->next;
 
-		if (__kfree_skb_reason(segs, reason)) {
+		if (__kfree_skb_reason(segs, NULL, reason)) {
 			skb_poison_list(segs);
 			kfree_skb_add_bulk(segs, &sa, reason);
 		}

@@ -1405,7 +1408,7 @@ void consume_skb(struct sk_buff *skb)
 	if (!skb_unref(skb))
 		return;
 
-	trace_consume_skb(skb, __builtin_return_address(0));
+	call_trace_consume_skb(skb, NULL, __builtin_return_address(0));
 	__kfree_skb(skb);
 }
 EXPORT_SYMBOL(consume_skb);

@@ -1420,7 +1423,7 @@ EXPORT_SYMBOL(consume_skb);
  */
 void __consume_stateless_skb(struct sk_buff *skb)
 {
-	trace_consume_skb(skb, __builtin_return_address(0));
+	call_trace_consume_skb(skb, NULL, __builtin_return_address(0));
 	skb_release_data(skb, SKB_CONSUMED);
 	kfree_skbmem(skb);
 }

@@ -1478,7 +1481,7 @@ void napi_consume_skb(struct sk_buff *skb, int budget)
 		return;
 
 	/* if reaching here SKB is ready to free */
-	trace_consume_skb(skb, __builtin_return_address(0));
+	call_trace_consume_skb(skb, NULL, __builtin_return_address(0));
 
 	/* if SKB is a clone, don't handle this case */
 	if (skb->fclone != SKB_FCLONE_UNAVAILABLE) {

2.30.2

This is a lot of code churn...

I have to ask : Why not simply adding an sk parameter to an existing trace point ?

If this not possible, I would rather add new tracepoints, adding new classes, because it will ease your debugging :

When looking for TCP drops, simply use a tcp_event_sk_skb_reason instance, and voila, no distractions caused by RAW/ICMP/ICMPv6/af_packet drops.

DECLARE_EVENT_CLASS(tcp_event_sk_skb_reason,

TP_PROTO(const struct sock *sk, const struct sk_buff *skb, enum
skb_drop_reason reason),
...
);

Also, the name ( kfree_skb_for_sk) and order of parameters is confusing.

I always prefer this kind of ordering/names :

void sk_skb_reason_drop( [struct net *net ] // not relevant here, but to expand the rationale
struct sock *sk, struct sk_buff *skb, enum skb_drop_reason reason)

Looking at the name, we immediately see the parameter order.

The consume one (no @reason there) would be called

void sk_skb_consume(struct sock *sk, struct sk_buff *skb);

Hi Eric,

Thanks for the feedback.

Modifying a signature of the current tracepoint seems like a breaking change, that's why I was saving the context inside skb->cb, hoping to not impact any existing programs watching this tracepoint. But thinking it twice, it might not cause a problem if the signature becomes:

trace_kfree_skb(const struct sk_buff *skb, void *location, enum
skb_drop_reason reason, const struct sock *sk)

As return values are usually not a thing for tracepoints, it is probably still compatible. The cons is that the last "sk" still breaks the integrity of naming. How about making a "kfree_skb_context" internal struct and putting it as the last argument to "hide" the naming confusion?

The alternative of adding another tracepoint could indeed work, we had a few cases like that in the past, e.g.

https://lore.kernel.org/lkml/[email protected]/
https://lore.kernel.org/netdev/[email protected]/

But it does feel like a whack-a-mole thing. The problems are solvable if we extend the kfree_skb tracepoint, so I would prefer to not add a new tracepoint.

I was intending to keep the "kfree_skb" prefix initially since it would appear less surprising to kernel developers who used kfree_skb and kfree_skb_reason. But your points do make good sense. How about "kfree_sk_skb_reason" and "consume_sk_skb" here?

thanks
Yan

Solvable with many future merge conflicts for stable teams.

IMO kfree_skb() and consume_skb() were a wrong choice. We have to live with them.

It should have been skb_free(), skb_consume(), skb_alloc(), to be consistent.

Following (partial) list was much better:

skb_add_rx_frag_netmem, skb_coalesce_rx_frag, skb_pp_cow_data, skb_cow_data_for_xdp,
skb_dump, skb_tx_error, skb_morph, skb_zerocopy_iter_stream, skb_copy_ubufs, skb_clone, skb_headers_offset_update, skb_copy_header, skb_copy, skb_realloc_headroom, skb_expand_head, skb_copy_expand, skb_put, skb_push, skb_pull, skb_pull_data, skb_trim, skb_copy_bits, skb_splice_bits, skb_send_sock_locked, skb_store_bits, skb_checksum, skb_copy_and_csum_bits, skb_zerocopy_headlen, skb_zerocopy, skb_copy_and_csum_dev, skb_dequeue, skb_dequeue_tail, skb_queue_purge_reason, skb_errqueue_purge, skb_queue_head, skb_queue_tail, skb_unlink, skb_append, skb_split, skb_prepare_seq_read, skb_seq_read, skb_abort_seq_read, skb_find_text, skb_append_pagefrags, skb_pull_rcsum, skb_segment_list, skb_segment, skb_to_sgvec, skb_to_sgvec_nomark, skb_cow_data, skb_clone_sk, skb_complete_tx_timestamp, skb_tstamp_tx, skb_complete_wifi_ack, skb_partial_csum_set, skb_checksum_setup, skb_checksum_trimmed, skb_try_coalesce, skb_scrub_packet, skb_vlan_untag, skb_ensure_writable, skb_ensure_writable_head_tail, skb_vlan_pop, skb_vlan_push, skb_eth_pop, skb_eth_push, skb_mpls_push, skb_mpls_pop, skb_mpls_update_lse, skb_mpls_dec_ttl, skb_condense, skb_ext_add, skb_splice_from_iter

(just to make my point very very clear)

Instead we have a myriad of functions with illogical parameter ordering vs their names.

I see no reason to add more confusion for new helpers.

I don't quite follow it. I think this specific commit using skb->cb is unnecessary so I am going to re-work it. As you initially mentioned, maybe I should just extend kfree_skb tracepoint. I saw a similar change dd1b527831a3("net: add location to trace_consume_skb()"), is it something I might follow, or do you specifically mean changes like this can annoy stable teams?

ACK. Thanks for clarifying.

Yan

I do not think trace points arguments are put in stone.

If they were, I would nack the addition of new tracepoints, to prevent ossification.

Use kfree_skb_for_sk call to pass on the rx socket

---
 net/ipv4/ping.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 823306487a82..e2f9866f67c7 100644
@@ -946,7 +946,7 @@ static enum skb_drop_reason __ping_queue_rcv_skb(struct sock *sk,
 	pr_debug("ping_queue_rcv_skb(sk=%p,sk->num=%d,skb=%p)\n",
 		 inet_sk(sk), inet_sk(sk)->inet_num, skb);
 	if (sock_queue_rcv_skb_reason(sk, skb, &reason) < 0) {
-		kfree_skb_reason(skb, reason);
+		kfree_skb_for_sk(skb, sk, reason);
 		pr_debug("ping_queue_rcv_skb -> failed\n");
 		return reason;
 	}

2.30.2

Use kfree_skb_for_sk call to pass on the rx socket

---
 net/ipv4/raw.c | 4 ++--
 net/ipv6/raw.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

index 1a0953650356..429498420eb3 100644
@@ -301,7 +301,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 	ipv4_pktinfo_prepare(sk, skb, true);
 	if (sock_queue_rcv_skb_reason(sk, skb, &reason) < 0) {
-		kfree_skb_reason(skb, reason);
+		kfree_skb_for_sk(skb, sk, reason);
 		return NET_RX_DROP;
 	}
 

@@ -312,7 +312,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
 {
 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
 		atomic_inc(&sk->sk_drops);
-		kfree_skb_reason(skb, SKB_DROP_REASON_XFRM_POLICY);
+		kfree_skb_for_sk(skb, sk, SKB_DROP_REASON_XFRM_POLICY);
 		return NET_RX_DROP;
 	}
 	nf_reset_ct(skb);

index f838366e8256..c927075f013f 100644
@@ -362,14 +362,14 @@ static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
 	if ((raw6_sk(sk)->checksum || rcu_access_pointer(sk->sk_filter)) &&
 	    skb_checksum_complete(skb)) {
 		atomic_inc(&sk->sk_drops);
-		kfree_skb_reason(skb, SKB_DROP_REASON_SKB_CSUM);
+		kfree_skb_for_sk(skb, sk, SKB_DROP_REASON_SKB_CSUM);
 		return NET_RX_DROP;
 	}
 
 	/* Charge it to the socket. */
 	skb_dst_drop(skb);
 	if (sock_queue_rcv_skb_reason(sk, skb, &reason) < 0) {
-		kfree_skb_reason(skb, reason);
+		kfree_skb_for_sk(skb, sk, reason);
 		return NET_RX_DROP;
 	}
 

@@ -390,7 +390,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
 		atomic_inc(&sk->sk_drops);
-		kfree_skb_reason(skb, SKB_DROP_REASON_XFRM_POLICY);
+		kfree_skb_for_sk(skb, sk, SKB_DROP_REASON_XFRM_POLICY);
 		return NET_RX_DROP;
 	}
 	nf_reset_ct(skb);

@@ -415,7 +415,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 	if (inet_test_bit(HDRINCL, sk)) {
 		if (skb_checksum_complete(skb)) {
 			atomic_inc(&sk->sk_drops);
-			kfree_skb_reason(skb, SKB_DROP_REASON_SKB_CSUM);
+			kfree_skb_for_sk(skb, sk, SKB_DROP_REASON_SKB_CSUM);
 			return NET_RX_DROP;
 		}
 	}

2.30.2

Use kfree_skb_for_sk call to pass on the rx socket

---
 net/ipv4/syncookies.c | 2 +-
 net/ipv4/tcp_input.c  | 2 +-
 net/ipv4/tcp_ipv4.c   | 4 ++--
 net/ipv6/syncookies.c | 2 +-
 net/ipv6/tcp_ipv6.c   | 4 ++--
 5 files changed, 7 insertions(+), 7 deletions(-)

index b61d36810fe3..fd0ccf0a0439 100644
@@ -496,6 +496,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
 out_free:
 	reqsk_free(req);
 out_drop:
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 	return NULL;
 }

index 9c04a9c8be9d..6c5f6fe7d9fa 100644
@@ -4849,7 +4849,7 @@ static void tcp_drop_reason(struct sock *sk, struct sk_buff *skb,
 			    enum skb_drop_reason reason)
 {
 	sk_drops_add(sk, skb);
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 }
 
 /* This one checks to see if we can put data from the

index 8f70b8d1d1e5..cff9e0c7daec 100644
@@ -1944,7 +1944,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 reset:
 	tcp_v4_send_reset(rsk, skb, sk_rst_convert_drop_reason(reason));
 discard:
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 	/* Be careful here. If this function gets more complicated and
 	 * gcc suffers from register pressure on the x86, sk (in %ebx)
 	 * might be destroyed here. This current version compiles correctly,

@@ -2381,7 +2381,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
 discard_it:
 	SKB_DR_OR(drop_reason, NOT_SPECIFIED);
 	/* Discard frame. */
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return 0;
 
 discard_and_relse:

index bfad1e89b6a6..d09fec4bb0c0 100644
@@ -275,6 +275,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 out_free:
 	reqsk_free(req);
 out_drop:
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 	return NULL;
 }

index 750aa681779c..c7a7f339ca74 100644
@@ -1682,7 +1682,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
 discard:
 	if (opt_skb)
 		__kfree_skb(opt_skb);
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 	return 0;
 csum_err:
 	reason = SKB_DROP_REASON_TCP_CSUM;

@@ -1948,7 +1948,7 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
 
 discard_it:
 	SKB_DR_OR(drop_reason, NOT_SPECIFIED);
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return 0;
 
 discard_and_relse:

2.30.2

Hi Yan,

[This is a private test report for your RFC patch.] kernel test robot noticed the following build warnings:

url:    https://github.com/intel-lab-lkp/linux/commits/Yan-Zhai/net-add-kfree_skb_for_sk-function/20240531-055120
base:   net-next/main
patch link:    https://lore.kernel.org/r/48392b4d422dd64cb8e76822737928c189b2b4d2.1717105215.git.yan%40cloudflare.com
patch subject: [RFC net-next 4/6] tcp: pass rx socket on rcv drops
config: i386-randconfig-141-20240601 (https://download.01.org/0day-ci/archive/20240601/[email protected]/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags

| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
net/ipv4/tcp_ipv4.c:2379 tcp_v4_rcv() error: uninitialized symbol 'sk'. net/ipv6/tcp_ipv6.c:1947 tcp_v6_rcv() error: uninitialized symbol 'sk'.

vim +/sk +2379 net/ipv4/tcp_ipv4.c

^1da177e4c3f41 Linus Torvalds           2005-04-16  2171  int tcp_v4_rcv(struct sk_buff *skb)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2172  {
3b24d854cb3538 Eric Dumazet             2016-04-01  2173  	struct net *net = dev_net(skb->dev);
643b622b51f1f0 Menglong Dong            2022-02-20  2174  	enum skb_drop_reason drop_reason;
3fa6f616a7a4d0 David Ahern              2017-08-07  2175  	int sdif = inet_sdif(skb);
534322ca3daf56 David Ahern              2019-12-30  2176  	int dif = inet_iif(skb);
eddc9ec53be2ec Arnaldo Carvalho de Melo 2007-04-20  2177  	const struct iphdr *iph;
cf533ea53ebfae Eric Dumazet             2011-10-21  2178  	const struct tcphdr *th;
3b24d854cb3538 Eric Dumazet             2016-04-01  2179  	bool refcounted;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2180  	struct sock *sk;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2181  	int ret;
41eecbd712b73f Eric Dumazet             2024-04-07  2182  	u32 isn;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2183  
85125597419aec Menglong Dong            2022-01-09  2184  	drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2185  	if (skb->pkt_type != PACKET_HOST)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2186  		goto discard_it;

sk not initliazed here.

^1da177e4c3f41 Linus Torvalds           2005-04-16  2187  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2188  	/* Count it even if it's bad */
90bbcc608369a1 Eric Dumazet             2016-04-27  2189  	__TCP_INC_STATS(net, TCP_MIB_INSEGS);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2190  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2191  	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
^1da177e4c3f41 Linus Torvalds           2005-04-16  2192  		goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2193  
ea1627c20c3462 Eric Dumazet             2016-05-13  2194  	th = (const struct tcphdr *)skb->data;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2195  
85125597419aec Menglong Dong            2022-01-09  2196  	if (unlikely(th->doff < sizeof(struct tcphdr) / 4)) {
85125597419aec Menglong Dong            2022-01-09  2197  		drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2198  		goto bad_packet;
85125597419aec Menglong Dong            2022-01-09  2199  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2200  	if (!pskb_may_pull(skb, th->doff * 4))
^1da177e4c3f41 Linus Torvalds           2005-04-16  2201  		goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2202  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2203  	/* An explanation is required here, I think.
^1da177e4c3f41 Linus Torvalds           2005-04-16  2204  	 * Packet length and doff are validated by header prediction,
caa20d9abe810b Stephen Hemminger        2005-11-10  2205  	 * provided case of th->doff==0 is eliminated.
^1da177e4c3f41 Linus Torvalds           2005-04-16  2206  	 * So, we defer the checks. */
ed70fcfcee953a Tom Herbert              2014-05-02  2207  
ed70fcfcee953a Tom Herbert              2014-05-02  2208  	if (skb_checksum_init(skb, IPPROTO_TCP, inet_compute_pseudo))
6a5dc9e598fe90 Eric Dumazet             2013-04-29  2209  		goto csum_error;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2210  
ea1627c20c3462 Eric Dumazet             2016-05-13  2211  	th = (const struct tcphdr *)skb->data;
eddc9ec53be2ec Arnaldo Carvalho de Melo 2007-04-20  2212  	iph = ip_hdr(skb);
4bdc3d66147b3a Eric Dumazet             2015-10-13  2213  lookup:
4461568aa4e565 Kuniyuki Iwashima        2022-09-07  2214  	sk = __inet_lookup_skb(net->ipv4.tcp_death_row.hashinfo,
4461568aa4e565 Kuniyuki Iwashima        2022-09-07  2215  			       skb, __tcp_hdrlen(th), th->source,
3fa6f616a7a4d0 David Ahern              2017-08-07  2216  			       th->dest, sdif, &refcounted);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2217  	if (!sk)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2218  		goto no_tcp_socket;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2219  
bb134d5d9580fc Eric Dumazet             2010-03-09  2220  	if (sk->sk_state == TCP_TIME_WAIT)
bb134d5d9580fc Eric Dumazet             2010-03-09  2221  		goto do_time_wait;
bb134d5d9580fc Eric Dumazet             2010-03-09  2222  
079096f103faca Eric Dumazet             2015-10-02  2223  	if (sk->sk_state == TCP_NEW_SYN_RECV) {
079096f103faca Eric Dumazet             2015-10-02  2224  		struct request_sock *req = inet_reqsk(sk);
e0f9759f530bf7 Eric Dumazet             2018-02-13  2225  		bool req_stolen = false;
7716682cc58e30 Eric Dumazet             2016-02-18  2226  		struct sock *nsk;
079096f103faca Eric Dumazet             2015-10-02  2227  
079096f103faca Eric Dumazet             2015-10-02  2228  		sk = req->rsk_listener;
6f0012e35160cd Eric Dumazet             2022-06-23  2229  		if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
6f0012e35160cd Eric Dumazet             2022-06-23  2230  			drop_reason = SKB_DROP_REASON_XFRM_POLICY;
6f0012e35160cd Eric Dumazet             2022-06-23  2231  		else
0a3a809089eb1d Dmitry Safonov           2023-10-23  2232  			drop_reason = tcp_inbound_hash(sk, req, skb,
7bbb765b734966 Dmitry Safonov           2022-02-23  2233  						       &iph->saddr, &iph->daddr,
1330b6ef3313fc Jakub Kicinski           2022-03-07  2234  						       AF_INET, dif, sdif);
1330b6ef3313fc Jakub Kicinski           2022-03-07  2235  		if (unlikely(drop_reason)) {
e65c332de8a0c9 Eric Dumazet             2016-08-24  2236  			sk_drops_add(sk, skb);
729235554d805c Eric Dumazet             2016-02-11  2237  			reqsk_put(req);
729235554d805c Eric Dumazet             2016-02-11  2238  			goto discard_it;
729235554d805c Eric Dumazet             2016-02-11  2239  		}
4fd44a98ffe0d0 Frank van der Linden     2018-06-12  2240  		if (tcp_checksum_complete(skb)) {
4fd44a98ffe0d0 Frank van der Linden     2018-06-12  2241  			reqsk_put(req);
4fd44a98ffe0d0 Frank van der Linden     2018-06-12  2242  			goto csum_error;
4fd44a98ffe0d0 Frank van der Linden     2018-06-12  2243  		}
7716682cc58e30 Eric Dumazet             2016-02-18  2244  		if (unlikely(sk->sk_state != TCP_LISTEN)) {
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2245  			nsk = reuseport_migrate_sock(sk, req_to_sk(req), skb);
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2246  			if (!nsk) {
f03f2e154f52fd Eric Dumazet             2015-10-14  2247  				inet_csk_reqsk_queue_drop_and_put(sk, req);
4bdc3d66147b3a Eric Dumazet             2015-10-13  2248  				goto lookup;
4bdc3d66147b3a Eric Dumazet             2015-10-13  2249  			}
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2250  			sk = nsk;
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2251  			/* reuseport_migrate_sock() has already held one sk_refcnt
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2252  			 * before returning.
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2253  			 */
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2254  		} else {
3b24d854cb3538 Eric Dumazet             2016-04-01  2255  			/* We own a reference on the listener, increase it again
3b24d854cb3538 Eric Dumazet             2016-04-01  2256  			 * as we might lose it too soon.
3b24d854cb3538 Eric Dumazet             2016-04-01  2257  			 */
7716682cc58e30 Eric Dumazet             2016-02-18  2258  			sock_hold(sk);
d4f2c86b2b7e2e Kuniyuki Iwashima        2021-06-12  2259  		}
3b24d854cb3538 Eric Dumazet             2016-04-01  2260  		refcounted = true;
1f3b359f1004bd Eric Dumazet             2017-09-08  2261  		nsk = NULL;
eeea10b83a1394 Eric Dumazet             2017-12-03  2262  		if (!tcp_filter(sk, skb)) {
eeea10b83a1394 Eric Dumazet             2017-12-03  2263  			th = (const struct tcphdr *)skb->data;
eeea10b83a1394 Eric Dumazet             2017-12-03  2264  			iph = ip_hdr(skb);
eeea10b83a1394 Eric Dumazet             2017-12-03  2265  			tcp_v4_fill_cb(skb, iph, th);
e0f9759f530bf7 Eric Dumazet             2018-02-13  2266  			nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
255f9034d3050f Menglong Dong            2022-02-20  2267  		} else {
255f9034d3050f Menglong Dong            2022-02-20  2268  			drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
eeea10b83a1394 Eric Dumazet             2017-12-03  2269  		}
079096f103faca Eric Dumazet             2015-10-02  2270  		if (!nsk) {
079096f103faca Eric Dumazet             2015-10-02  2271  			reqsk_put(req);
e0f9759f530bf7 Eric Dumazet             2018-02-13  2272  			if (req_stolen) {
e0f9759f530bf7 Eric Dumazet             2018-02-13  2273  				/* Another cpu got exclusive access to req
e0f9759f530bf7 Eric Dumazet             2018-02-13  2274  				 * and created a full blown socket.
e0f9759f530bf7 Eric Dumazet             2018-02-13  2275  				 * Try to feed this packet to this socket
e0f9759f530bf7 Eric Dumazet             2018-02-13  2276  				 * instead of discarding it.
e0f9759f530bf7 Eric Dumazet             2018-02-13  2277  				 */
e0f9759f530bf7 Eric Dumazet             2018-02-13  2278  				tcp_v4_restore_cb(skb);
e0f9759f530bf7 Eric Dumazet             2018-02-13  2279  				sock_put(sk);
e0f9759f530bf7 Eric Dumazet             2018-02-13  2280  				goto lookup;
e0f9759f530bf7 Eric Dumazet             2018-02-13  2281  			}
7716682cc58e30 Eric Dumazet             2016-02-18  2282  			goto discard_and_relse;
079096f103faca Eric Dumazet             2015-10-02  2283  		}
6f0012e35160cd Eric Dumazet             2022-06-23  2284  		nf_reset_ct(skb);
079096f103faca Eric Dumazet             2015-10-02  2285  		if (nsk == sk) {
079096f103faca Eric Dumazet             2015-10-02  2286  			reqsk_put(req);
eeea10b83a1394 Eric Dumazet             2017-12-03  2287  			tcp_v4_restore_cb(skb);
ee01defe25bad0 Jason Xing               2024-02-26  2288  		} else {
ee01defe25bad0 Jason Xing               2024-02-26  2289  			drop_reason = tcp_child_process(sk, nsk, skb);
ee01defe25bad0 Jason Xing               2024-02-26  2290  			if (drop_reason) {
120391ef9ca8fe Jason Xing               2024-04-25  2291  				enum sk_rst_reason rst_reason;
120391ef9ca8fe Jason Xing               2024-04-25  2292  
120391ef9ca8fe Jason Xing               2024-04-25  2293  				rst_reason = sk_rst_convert_drop_reason(drop_reason);
120391ef9ca8fe Jason Xing               2024-04-25  2294  				tcp_v4_send_reset(nsk, skb, rst_reason);
7716682cc58e30 Eric Dumazet             2016-02-18  2295  				goto discard_and_relse;
ee01defe25bad0 Jason Xing               2024-02-26  2296  			}
7716682cc58e30 Eric Dumazet             2016-02-18  2297  			sock_put(sk);
079096f103faca Eric Dumazet             2015-10-02  2298  			return 0;
079096f103faca Eric Dumazet             2015-10-02  2299  		}
079096f103faca Eric Dumazet             2015-10-02  2300  	}
14834c4f4eb3c8 Eric Dumazet             2021-10-25  2301  
d13b05962369ba Eric Dumazet             2024-04-11  2302  process:
020e71a3cf7f50 Eric Dumazet             2021-10-25  2303  	if (static_branch_unlikely(&ip4_min_ttl)) {
14834c4f4eb3c8 Eric Dumazet             2021-10-25  2304  		/* min_ttl can be changed concurrently from do_ip_setsockopt() */
14834c4f4eb3c8 Eric Dumazet             2021-10-25  2305  		if (unlikely(iph->ttl < READ_ONCE(inet_sk(sk)->min_ttl))) {
02a1d6e7a6bb02 Eric Dumazet             2016-04-27  2306  			__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
2798e36dc233a4 Eric Dumazet             2023-02-01  2307  			drop_reason = SKB_DROP_REASON_TCP_MINTTL;
d218d11133d888 Stephen Hemminger        2010-01-11  2308  			goto discard_and_relse;
6cce09f87a0479 Eric Dumazet             2010-03-07  2309  		}
020e71a3cf7f50 Eric Dumazet             2021-10-25  2310  	}
d218d11133d888 Stephen Hemminger        2010-01-11  2311  
255f9034d3050f Menglong Dong            2022-02-20  2312  	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
255f9034d3050f Menglong Dong            2022-02-20  2313  		drop_reason = SKB_DROP_REASON_XFRM_POLICY;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2314  		goto discard_and_relse;
255f9034d3050f Menglong Dong            2022-02-20  2315  	}
9ea88a153001ff Dmitry Popov             2014-08-07  2316  
0a3a809089eb1d Dmitry Safonov           2023-10-23  2317  	drop_reason = tcp_inbound_hash(sk, NULL, skb, &iph->saddr, &iph->daddr,
0a3a809089eb1d Dmitry Safonov           2023-10-23  2318  				       AF_INET, dif, sdif);
1330b6ef3313fc Jakub Kicinski           2022-03-07  2319  	if (drop_reason)
9ea88a153001ff Dmitry Popov             2014-08-07  2320  		goto discard_and_relse;
9ea88a153001ff Dmitry Popov             2014-08-07  2321  
895b5c9f206eb7 Florian Westphal         2019-09-29  2322  	nf_reset_ct(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2323  
85125597419aec Menglong Dong            2022-01-09  2324  	if (tcp_filter(sk, skb)) {
364df53c081d93 Menglong Dong            2022-01-27  2325  		drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2326  		goto discard_and_relse;
85125597419aec Menglong Dong            2022-01-09  2327  	}
ac6e780070e30e Eric Dumazet             2016-11-10  2328  	th = (const struct tcphdr *)skb->data;
ac6e780070e30e Eric Dumazet             2016-11-10  2329  	iph = ip_hdr(skb);
eeea10b83a1394 Eric Dumazet             2017-12-03  2330  	tcp_v4_fill_cb(skb, iph, th);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2331  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2332  	skb->dev = NULL;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2333  
e994b2f0fb9229 Eric Dumazet             2015-10-02  2334  	if (sk->sk_state == TCP_LISTEN) {
e994b2f0fb9229 Eric Dumazet             2015-10-02  2335  		ret = tcp_v4_do_rcv(sk, skb);
e994b2f0fb9229 Eric Dumazet             2015-10-02  2336  		goto put_and_return;
e994b2f0fb9229 Eric Dumazet             2015-10-02  2337  	}
e994b2f0fb9229 Eric Dumazet             2015-10-02  2338  
e994b2f0fb9229 Eric Dumazet             2015-10-02  2339  	sk_incoming_cpu_update(sk);
e994b2f0fb9229 Eric Dumazet             2015-10-02  2340  
c63661848581a9 Ingo Molnar              2006-07-03  2341  	bh_lock_sock_nested(sk);
a44d6eacdaf56f Martin KaFai Lau         2016-03-14  2342  	tcp_segs_in(tcp_sk(sk), skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2343  	ret = 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2344  	if (!sock_owned_by_user(sk)) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2345  		ret = tcp_v4_do_rcv(sk, skb);
8b27dae5a2e89a Eric Dumazet             2019-03-22  2346  	} else {
7a26dc9e7b43f5 Menglong Dong            2022-02-20  2347  		if (tcp_add_backlog(sk, skb, &drop_reason))
6b03a53a5ab7cc Zhu Yi                   2010-03-04  2348  			goto discard_and_relse;
6b03a53a5ab7cc Zhu Yi                   2010-03-04  2349  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2350  	bh_unlock_sock(sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2351  
e994b2f0fb9229 Eric Dumazet             2015-10-02  2352  put_and_return:
3b24d854cb3538 Eric Dumazet             2016-04-01  2353  	if (refcounted)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2354  		sock_put(sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2355  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2356  	return ret;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2357  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2358  no_tcp_socket:
85125597419aec Menglong Dong            2022-01-09  2359  	drop_reason = SKB_DROP_REASON_NO_SOCKET;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2360  	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
^1da177e4c3f41 Linus Torvalds           2005-04-16  2361  		goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2362  
eeea10b83a1394 Eric Dumazet             2017-12-03  2363  	tcp_v4_fill_cb(skb, iph, th);
eeea10b83a1394 Eric Dumazet             2017-12-03  2364  
12e25e1041d044 Eric Dumazet             2015-06-03  2365  	if (tcp_checksum_complete(skb)) {
6a5dc9e598fe90 Eric Dumazet             2013-04-29  2366  csum_error:
85125597419aec Menglong Dong            2022-01-09  2367  		drop_reason = SKB_DROP_REASON_TCP_CSUM;
709c0314239992 Jakub Kicinski           2021-05-14  2368  		trace_tcp_bad_csum(skb);
90bbcc608369a1 Eric Dumazet             2016-04-27  2369  		__TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2370  bad_packet:
90bbcc608369a1 Eric Dumazet             2016-04-27  2371  		__TCP_INC_STATS(net, TCP_MIB_INERRS);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2372  	} else {
120391ef9ca8fe Jason Xing               2024-04-25  2373  		tcp_v4_send_reset(NULL, skb, sk_rst_convert_drop_reason(drop_reason));
^1da177e4c3f41 Linus Torvalds           2005-04-16  2374  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2375  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2376  discard_it:
f8319dfd1b3b3b Menglong Dong            2022-05-13  2377  	SKB_DR_OR(drop_reason, NOT_SPECIFIED);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2378  	/* Discard frame. */
ba5a91847cf5d8 Yan Zhai                 2024-05-30 @2379  	kfree_skb_for_sk(skb, sk, drop_reason);
                                                                                      ^^

Uninitialized.

^1da177e4c3f41 Linus Torvalds           2005-04-16  2380  	return 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2381  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2382  discard_and_relse:
532182cd610782 Eric Dumazet             2016-04-01  2383  	sk_drops_add(sk, skb);
3b24d854cb3538 Eric Dumazet             2016-04-01  2384  	if (refcounted)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2385  		sock_put(sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2386  	goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2387  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2388  do_time_wait:
^1da177e4c3f41 Linus Torvalds           2005-04-16  2389  	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
255f9034d3050f Menglong Dong            2022-02-20  2390  		drop_reason = SKB_DROP_REASON_XFRM_POLICY;
9469c7b4aa210c YOSHIFUJI Hideaki        2006-10-10  2391  		inet_twsk_put(inet_twsk(sk));
^1da177e4c3f41 Linus Torvalds           2005-04-16  2392  		goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2393  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2394  
eeea10b83a1394 Eric Dumazet             2017-12-03  2395  	tcp_v4_fill_cb(skb, iph, th);
eeea10b83a1394 Eric Dumazet             2017-12-03  2396  
6a5dc9e598fe90 Eric Dumazet             2013-04-29  2397  	if (tcp_checksum_complete(skb)) {
6a5dc9e598fe90 Eric Dumazet             2013-04-29  2398  		inet_twsk_put(inet_twsk(sk));
6a5dc9e598fe90 Eric Dumazet             2013-04-29  2399  		goto csum_error;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2400  	}
41eecbd712b73f Eric Dumazet             2024-04-07  2401  	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn)) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2402  	case TCP_TW_SYN: {
4461568aa4e565 Kuniyuki Iwashima        2022-09-07  2403  		struct sock *sk2 = inet_lookup_listener(net,
4461568aa4e565 Kuniyuki Iwashima        2022-09-07  2404  							net->ipv4.tcp_death_row.hashinfo,
4461568aa4e565 Kuniyuki Iwashima        2022-09-07  2405  							skb, __tcp_hdrlen(th),
da5e36308d9f71 Tom Herbert              2013-01-22  2406  							iph->saddr, th->source,
eddc9ec53be2ec Arnaldo Carvalho de Melo 2007-04-20  2407  							iph->daddr, th->dest,
3fa6f616a7a4d0 David Ahern              2017-08-07  2408  							inet_iif(skb),
3fa6f616a7a4d0 David Ahern              2017-08-07  2409  							sdif);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2410  		if (sk2) {
dbe7faa4045ea8 Eric Dumazet             2015-07-08  2411  			inet_twsk_deschedule_put(inet_twsk(sk));
^1da177e4c3f41 Linus Torvalds           2005-04-16  2412  			sk = sk2;
eeea10b83a1394 Eric Dumazet             2017-12-03  2413  			tcp_v4_restore_cb(skb);
3b24d854cb3538 Eric Dumazet             2016-04-01  2414  			refcounted = false;
41eecbd712b73f Eric Dumazet             2024-04-07  2415  			__this_cpu_write(tcp_tw_isn, isn);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2416  			goto process;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2417  		}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2418  	}
fcfd6dfab97006 Gustavo A. R. Silva      2017-10-16  2419  		/* to ACK */
a8eceea84a3a35 Joe Perches              2020-03-12  2420  		fallthrough;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2421  	case TCP_TW_ACK:
^1da177e4c3f41 Linus Torvalds           2005-04-16  2422  		tcp_v4_timewait_ack(sk, skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2423  		break;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2424  	case TCP_TW_RST:
22a32557758a71 Jason Xing               2024-05-10  2425  		tcp_v4_send_reset(sk, skb, SK_RST_REASON_TCP_TIMEWAIT_SOCKET);
271c3b9b7bdae0 Florian Westphal         2015-12-21  2426  		inet_twsk_deschedule_put(inet_twsk(sk));
271c3b9b7bdae0 Florian Westphal         2015-12-21  2427  		goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2428  	case TCP_TW_SUCCESS:;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2429  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2430  	goto discard_it;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2431  }

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Use kfree_skb_for_sk call to pass on the rx socket

---
 net/ipv4/udp.c | 6 +++---
 net/ipv6/udp.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

index 189c9113fe9a..e5dbd1cbad50 100644
@@ -2074,7 +2074,7 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 		UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
 		trace_udp_fail_queue_rcv_skb(rc, sk, skb);
-		kfree_skb_reason(skb, drop_reason);
+		kfree_skb_for_sk(skb, sk, drop_reason);
 		return -1;
 	}
 

@@ -2196,7 +2196,7 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
 drop:
 	__UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
 	atomic_inc(&sk->sk_drops);
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return -1;
 }
 

@@ -2485,7 +2485,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 	__UDP_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
 drop:
 	__UDP_INC_STATS(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return 0;
 }
 

index c81a07ac0463..97a327c759b8 100644
@@ -673,7 +673,7 @@ static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 		UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
 		trace_udp_fail_queue_rcv_skb(rc, sk, skb);
-		kfree_skb_reason(skb, drop_reason);
+		kfree_skb_for_sk(skb, sk, drop_reason);
 		return -1;
 	}
 

@@ -776,7 +776,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
 drop:
 	__UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
 	atomic_inc(&sk->sk_drops);
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return -1;
 }
 

@@ -1054,7 +1054,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 	__UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
 discard:
 	__UDP6_INC_STATS(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
-	kfree_skb_reason(skb, reason);
+	kfree_skb_for_sk(skb, sk, reason);
 	return 0;
 }
 

2.30.2

Hi Yan,

[This is a private test report for your RFC patch.] kernel test robot noticed the following build warnings:

url:    https://github.com/intel-lab-lkp/linux/commits/Yan-Zhai/net-add-kfree_skb_for_sk-function/20240531-055120
base:   net-next/main
patch link:    https://lore.kernel.org/r/64c8339aa96232b5d36738162e7bf58412bf6682.1717105215.git.yan%40cloudflare.com
patch subject: [RFC net-next 5/6] udp: pass rx socket on rcv drops
config: i386-randconfig-141-20240601 (https://download.01.org/0day-ci/archive/20240601/[email protected]/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags

| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
net/ipv6/udp.c:1057 __udp6_lib_rcv() error: uninitialized symbol 'sk'. net/ipv4/udp.c:2488 __udp4_lib_rcv() error: uninitialized symbol 'sk'.

vim +/sk +1057 net/ipv6/udp.c

645ca708f936b2 Eric Dumazet             2008-10-29   937  int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
759e5d006462d5 Herbert Xu               2007-03-25   938  		   int proto)
^1da177e4c3f41 Linus Torvalds           2005-04-16   939  {
4cf91f825b2777 David Ahern              2022-02-11   940  	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
ca065d0cf80fa5 Eric Dumazet             2016-04-01   941  	const struct in6_addr *saddr, *daddr;
3ffe533c87281b Alexey Dobriyan          2010-02-18   942  	struct net *net = dev_net(skb->dev);
^1da177e4c3f41 Linus Torvalds           2005-04-16   943  	struct udphdr *uh;
ca065d0cf80fa5 Eric Dumazet             2016-04-01   944  	struct sock *sk;
71489e21d720a0 Joe Stringer             2020-03-29   945  	bool refcounted;
^1da177e4c3f41 Linus Torvalds           2005-04-16   946  	u32 ulen = 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16   947  
^1da177e4c3f41 Linus Torvalds           2005-04-16   948  	if (!pskb_may_pull(skb, sizeof(struct udphdr)))

d6bc0149d8f230 Bjørn Mork 2010-05-06 949 goto discard;

sk uninitialized

^1da177e4c3f41 Linus Torvalds           2005-04-16   950  
0660e03f6b18f1 Arnaldo Carvalho de Melo 2007-04-25   951  	saddr = &ipv6_hdr(skb)->saddr;
0660e03f6b18f1 Arnaldo Carvalho de Melo 2007-04-25   952  	daddr = &ipv6_hdr(skb)->daddr;
4bedb45203eab9 Arnaldo Carvalho de Melo 2007-03-13   953  	uh = udp_hdr(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16   954  
^1da177e4c3f41 Linus Torvalds           2005-04-16   955  	ulen = ntohs(uh->len);
ba4e58eca8aa94 Gerrit Renker            2006-11-27   956  	if (ulen > skb->len)
ba4e58eca8aa94 Gerrit Renker            2006-11-27   957  		goto short_packet;
ba4e58eca8aa94 Gerrit Renker            2006-11-27   958  
759e5d006462d5 Herbert Xu               2007-03-25   959  	if (proto == IPPROTO_UDP) {
759e5d006462d5 Herbert Xu               2007-03-25   960  		/* UDP validates ulen. */
^1da177e4c3f41 Linus Torvalds           2005-04-16   961  
^1da177e4c3f41 Linus Torvalds           2005-04-16   962  		/* Check for jumbo payload */
^1da177e4c3f41 Linus Torvalds           2005-04-16   963  		if (ulen == 0)
^1da177e4c3f41 Linus Torvalds           2005-04-16   964  			ulen = skb->len;
^1da177e4c3f41 Linus Torvalds           2005-04-16   965  
ba4e58eca8aa94 Gerrit Renker            2006-11-27   966  		if (ulen < sizeof(*uh))
^1da177e4c3f41 Linus Torvalds           2005-04-16   967  			goto short_packet;
^1da177e4c3f41 Linus Torvalds           2005-04-16   968  
^1da177e4c3f41 Linus Torvalds           2005-04-16   969  		if (ulen < skb->len) {
42ca89c18b75e1 Stephen Hemminger        2005-09-08   970  			if (pskb_trim_rcsum(skb, ulen))
ba4e58eca8aa94 Gerrit Renker            2006-11-27   971  				goto short_packet;
0660e03f6b18f1 Arnaldo Carvalho de Melo 2007-04-25   972  			saddr = &ipv6_hdr(skb)->saddr;
0660e03f6b18f1 Arnaldo Carvalho de Melo 2007-04-25   973  			daddr = &ipv6_hdr(skb)->daddr;
4bedb45203eab9 Arnaldo Carvalho de Melo 2007-03-13   974  			uh = udp_hdr(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16   975  		}
759e5d006462d5 Herbert Xu               2007-03-25   976  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16   977  
759e5d006462d5 Herbert Xu               2007-03-25   978  	if (udp6_csum_init(skb, uh, proto))
6a5dc9e598fe90 Eric Dumazet             2013-04-29   979  		goto csum_error;
^1da177e4c3f41 Linus Torvalds           2005-04-16   980  
c9f2c1ae123a75 Paolo Abeni              2017-07-27   981  	/* Check if the socket is already available, e.g. due to early demux */
9c02bec9595425 Lorenz Bauer             2023-07-20   982  	sk = inet6_steal_sock(net, skb, sizeof(struct udphdr), saddr, uh->source, daddr, uh->dest,
9c02bec9595425 Lorenz Bauer             2023-07-20   983  			      &refcounted, udp6_ehashfn);
9c02bec9595425 Lorenz Bauer             2023-07-20   984  	if (IS_ERR(sk))
9c02bec9595425 Lorenz Bauer             2023-07-20   985  		goto no_sk;
9c02bec9595425 Lorenz Bauer             2023-07-20   986  
c9f2c1ae123a75 Paolo Abeni              2017-07-27   987  	if (sk) {
c9f2c1ae123a75 Paolo Abeni              2017-07-27   988  		struct dst_entry *dst = skb_dst(skb);
c9f2c1ae123a75 Paolo Abeni              2017-07-27   989  		int ret;
c9f2c1ae123a75 Paolo Abeni              2017-07-27   990  
8f905c0e7354ef Eric Dumazet             2021-12-20   991  		if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst))
64f0f5d18a47c7 Paolo Abeni              2017-08-25   992  			udp6_sk_rx_dst_set(sk, dst);
c9f2c1ae123a75 Paolo Abeni              2017-07-27   993  
bcbc1b1de88464 Eric Dumazet             2023-09-12   994  		if (!uh->check && !udp_get_no_check6_rx(sk)) {
71489e21d720a0 Joe Stringer             2020-03-29   995  			if (refcounted)
c9f2c1ae123a75 Paolo Abeni              2017-07-27   996  				sock_put(sk);
eb63f2964dbe36 Paolo Abeni              2018-09-13   997  			goto report_csum_error;
eb63f2964dbe36 Paolo Abeni              2018-09-13   998  		}
c9f2c1ae123a75 Paolo Abeni              2017-07-27   999  
eb63f2964dbe36 Paolo Abeni              2018-09-13  1000  		ret = udp6_unicast_rcv_skb(sk, skb, uh);
71489e21d720a0 Joe Stringer             2020-03-29  1001  		if (refcounted)
eb63f2964dbe36 Paolo Abeni              2018-09-13  1002  			sock_put(sk);
c9f2c1ae123a75 Paolo Abeni              2017-07-27  1003  		return ret;
c9f2c1ae123a75 Paolo Abeni              2017-07-27  1004  	}
c9f2c1ae123a75 Paolo Abeni              2017-07-27  1005  
^1da177e4c3f41 Linus Torvalds           2005-04-16  1006  	/*
^1da177e4c3f41 Linus Torvalds           2005-04-16  1007  	 *	Multicast receive code
^1da177e4c3f41 Linus Torvalds           2005-04-16  1008  	 */
ba4e58eca8aa94 Gerrit Renker            2006-11-27  1009  	if (ipv6_addr_is_multicast(daddr))
e31634931d0008 Pavel Emelyanov          2008-06-16  1010  		return __udp6_lib_mcast_deliver(net, skb,
36cbb2452cbafc Rick Jones               2014-11-06  1011  				saddr, daddr, udptable, proto);
^1da177e4c3f41 Linus Torvalds           2005-04-16  1012  
^1da177e4c3f41 Linus Torvalds           2005-04-16  1013  	/* Unicast */
607c4aaf03041c KOVACS Krisztian         2008-10-07  1014  	sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
53b24b8f94cb15 Ian Morris               2015-03-29  1015  	if (sk) {
bcbc1b1de88464 Eric Dumazet             2023-09-12  1016  		if (!uh->check && !udp_get_no_check6_rx(sk))
eb63f2964dbe36 Paolo Abeni              2018-09-13  1017  			goto report_csum_error;
eb63f2964dbe36 Paolo Abeni              2018-09-13  1018  		return udp6_unicast_rcv_skb(sk, skb, uh);
cb80ef463d1881 Benjamin LaHaise         2012-04-27  1019  	}
9c02bec9595425 Lorenz Bauer             2023-07-20  1020  no_sk:
4cf91f825b2777 David Ahern              2022-02-11  1021  	reason = SKB_DROP_REASON_NO_SOCKET;
4cf91f825b2777 David Ahern              2022-02-11  1022  
eb63f2964dbe36 Paolo Abeni              2018-09-13  1023  	if (!uh->check)
eb63f2964dbe36 Paolo Abeni              2018-09-13  1024  		goto report_csum_error;
4068579e1e098f Tom Herbert              2014-05-02  1025  
^1da177e4c3f41 Linus Torvalds           2005-04-16  1026  	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
^1da177e4c3f41 Linus Torvalds           2005-04-16  1027  		goto discard;
b0e214d212030f Madhu Koriginja          2023-03-21  1028  	nf_reset_ct(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  1029  
ba4e58eca8aa94 Gerrit Renker            2006-11-27  1030  	if (udp_lib_checksum_complete(skb))
6a5dc9e598fe90 Eric Dumazet             2013-04-29  1031  		goto csum_error;
^1da177e4c3f41 Linus Torvalds           2005-04-16  1032  
02c223470c3cc3 Eric Dumazet             2016-04-27  1033  	__UDP6_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
3ffe533c87281b Alexey Dobriyan          2010-02-18  1034  	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
^1da177e4c3f41 Linus Torvalds           2005-04-16  1035  
4cf91f825b2777 David Ahern              2022-02-11  1036  	kfree_skb_reason(skb, reason);
add459aa1afe05 Stephen Hemminger        2007-03-08  1037  	return 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  1038  
^1da177e4c3f41 Linus Torvalds           2005-04-16  1039  short_packet:
4cf91f825b2777 David Ahern              2022-02-11  1040  	if (reason == SKB_DROP_REASON_NOT_SPECIFIED)
4cf91f825b2777 David Ahern              2022-02-11  1041  		reason = SKB_DROP_REASON_PKT_TOO_SMALL;
ba7a46f16dd29f Joe Perches              2014-11-11  1042  	net_dbg_ratelimited("UDP%sv6: short packet: From [%pI6c]:%u %d/%d to [%pI6c]:%u\n",
db8dac20d51993 David S. Miller          2008-03-06  1043  			    proto == IPPROTO_UDPLITE ? "-Lite" : "",
ba7a46f16dd29f Joe Perches              2014-11-11  1044  			    saddr, ntohs(uh->source),
ba7a46f16dd29f Joe Perches              2014-11-11  1045  			    ulen, skb->len,
ba7a46f16dd29f Joe Perches              2014-11-11  1046  			    daddr, ntohs(uh->dest));
6a5dc9e598fe90 Eric Dumazet             2013-04-29  1047  	goto discard;
eb63f2964dbe36 Paolo Abeni              2018-09-13  1048  
eb63f2964dbe36 Paolo Abeni              2018-09-13  1049  report_csum_error:
eb63f2964dbe36 Paolo Abeni              2018-09-13  1050  	udp6_csum_zero_error(skb);
6a5dc9e598fe90 Eric Dumazet             2013-04-29  1051  csum_error:
4cf91f825b2777 David Ahern              2022-02-11  1052  	if (reason == SKB_DROP_REASON_NOT_SPECIFIED)
4cf91f825b2777 David Ahern              2022-02-11  1053  		reason = SKB_DROP_REASON_UDP_CSUM;
02c223470c3cc3 Eric Dumazet             2016-04-27  1054  	__UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
^1da177e4c3f41 Linus Torvalds           2005-04-16  1055  discard:
02c223470c3cc3 Eric Dumazet             2016-04-27  1056  	__UDP6_INC_STATS(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
f0a552b29db7b1 Yan Zhai                 2024-05-30 @1057  	kfree_skb_for_sk(skb, sk, reason);
                                                                                      ^^

add459aa1afe05 Stephen Hemminger        2007-03-08  1058  	return 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  1059  }

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Use kfree_skb_for_sk call to pass on the rx socket

---
 net/packet/af_packet.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index fce390887591..30a6447b4fc4 100644
@@ -2226,7 +2226,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
 		skb->len = skb_len;
 	}
 drop:
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return 0;
 }
 

@@ -2494,7 +2494,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
 		skb->len = skb_len;
 	}
 drop:
-	kfree_skb_reason(skb, drop_reason);
+	kfree_skb_for_sk(skb, sk, drop_reason);
 	return 0;
 
 drop_n_account:

@@ -2503,7 +2503,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
 	drop_reason = SKB_DROP_REASON_PACKET_SOCK_ERROR;
 
 	sk->sk_data_ready(sk);
-	kfree_skb_reason(copy_skb, drop_reason);
+	kfree_skb_for_sk(copy_skb, sk, drop_reason);
 	goto drop_n_restore;
 }
 

2.30.2

Hi Yan,

[This is a private test report for your RFC patch.] kernel test robot noticed the following build warnings:

url:    https://github.com/intel-lab-lkp/linux/commits/Yan-Zhai/net-add-kfree_skb_for_sk-function/20240531-055120
base:   net-next/main
patch link:    https://lore.kernel.org/r/df2ad57a2986038ae9b5e46c73d48c22bb86b788.1717105215.git.yan%40cloudflare.com
patch subject: [RFC net-next 6/6] af_packet: pass rx socket on rcv drops
config: i386-randconfig-141-20240601 (https://download.01.org/0day-ci/archive/20240601/[email protected]/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags

| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
net/packet/af_packet.c:2229 packet_rcv() error: uninitialized symbol 'sk'. net/packet/af_packet.c:2497 tpacket_rcv() error: uninitialized symbol 'sk'.

vim +/sk +2229 net/packet/af_packet.c

40d4e3dfc2f56a Eric Dumazet             2009-07-21  2120  static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
40d4e3dfc2f56a Eric Dumazet             2009-07-21  2121  		      struct packet_type *pt, struct net_device *orig_dev)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2122  {
2f57dd94bdef08 Yan Zhai                 2023-12-04  2123  	enum skb_drop_reason drop_reason = SKB_CONSUMED;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2124  	struct sock *sk;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2125  	struct sockaddr_ll *sll;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2126  	struct packet_sock *po;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2127  	u8 *skb_head = skb->data;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2128  	int skb_len = skb->len;
dbcb5855d108b7 David S. Miller          2007-01-24  2129  	unsigned int snaplen, res;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2130  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2131  	if (skb->pkt_type == PACKET_LOOPBACK)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2132  		goto drop;

sk uninitialized

^1da177e4c3f41 Linus Torvalds           2005-04-16  2133  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2134  	sk = pt->af_packet_priv;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2135  	po = pkt_sk(sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2136  
09ad9bc752519c Octavian Purdila         2009-11-25  2137  	if (!net_eq(dev_net(dev), sock_net(sk)))
d12d01d6b4d197 Denis V. Lunev           2007-11-19  2138  		goto drop;
d12d01d6b4d197 Denis V. Lunev           2007-11-19  2139  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2140  	skb->dev = dev;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2141  
d549699048b4b5 Eyal Birger              2020-11-21  2142  	if (dev_has_header(dev)) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2143  		/* The device has an explicit notion of ll header,
62ab0812137ec4 Eric Dumazet             2010-12-06  2144  		 * exported to higher levels.
62ab0812137ec4 Eric Dumazet             2010-12-06  2145  		 *
62ab0812137ec4 Eric Dumazet             2010-12-06  2146  		 * Otherwise, the device hides details of its frame
62ab0812137ec4 Eric Dumazet             2010-12-06  2147  		 * structure, so that corresponding packet head is
62ab0812137ec4 Eric Dumazet             2010-12-06  2148  		 * never delivered to user.
^1da177e4c3f41 Linus Torvalds           2005-04-16  2149  		 */
^1da177e4c3f41 Linus Torvalds           2005-04-16  2150  		if (sk->sk_type != SOCK_DGRAM)
98e399f82ab3a6 Arnaldo Carvalho de Melo 2007-03-19  2151  			skb_push(skb, skb->data - skb_mac_header(skb));
^1da177e4c3f41 Linus Torvalds           2005-04-16  2152  		else if (skb->pkt_type == PACKET_OUTGOING) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2153  			/* Special case: outgoing packets have ll header at head */
bbe735e4247dba Arnaldo Carvalho de Melo 2007-03-10  2154  			skb_pull(skb, skb_network_offset(skb));
^1da177e4c3f41 Linus Torvalds           2005-04-16  2155  		}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2156  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2157  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2158  	snaplen = skb->len;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2159  
dbcb5855d108b7 David S. Miller          2007-01-24  2160  	res = run_filter(skb, sk, snaplen);
dbcb5855d108b7 David S. Miller          2007-01-24  2161  	if (!res)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2162  		goto drop_n_restore;
dbcb5855d108b7 David S. Miller          2007-01-24  2163  	if (snaplen > res)
dbcb5855d108b7 David S. Miller          2007-01-24  2164  		snaplen = res;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2165  
0fd7bac6b6157e Eric Dumazet             2011-12-21  2166  	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2167  		goto drop_n_acct;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2168  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2169  	if (skb_shared(skb)) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2170  		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2171  		if (nskb == NULL)
^1da177e4c3f41 Linus Torvalds           2005-04-16  2172  			goto drop_n_acct;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2173  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2174  		if (skb_head != skb->data) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2175  			skb->data = skb_head;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2176  			skb->len = skb_len;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2177  		}
abc4e4fa29eb81 Eric Dumazet             2012-04-19  2178  		consume_skb(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2179  		skb = nskb;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2180  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2181  
b4772ef879a8f7 Eyal Birger              2015-03-01  2182  	sock_skb_cb_check_size(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8);
ffbc61117d32dc Herbert Xu               2007-02-04  2183  
ffbc61117d32dc Herbert Xu               2007-02-04  2184  	sll = &PACKET_SKB_CB(skb)->sa.ll;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2185  	sll->sll_hatype = dev->type;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2186  	sll->sll_pkttype = skb->pkt_type;
ee5675ecdf7a4e Eric Dumazet             2023-03-16  2187  	if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
80feaacb8a6400 Peter P. Waskiewicz Jr   2007-04-20  2188  		sll->sll_ifindex = orig_dev->ifindex;
80feaacb8a6400 Peter P. Waskiewicz Jr   2007-04-20  2189  	else
^1da177e4c3f41 Linus Torvalds           2005-04-16  2190  		sll->sll_ifindex = dev->ifindex;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2191  
b95cce3576813a Stephen Hemminger        2007-09-26  2192  	sll->sll_halen = dev_parse_header(skb, sll->sll_addr);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2193  
2472d7613bd3ba Eyal Birger              2015-03-01  2194  	/* sll->sll_family and sll->sll_protocol are set in packet_recvmsg().
2472d7613bd3ba Eyal Birger              2015-03-01  2195  	 * Use their space for storing the original skb length.
2472d7613bd3ba Eyal Birger              2015-03-01  2196  	 */
2472d7613bd3ba Eyal Birger              2015-03-01  2197  	PACKET_SKB_CB(skb)->sa.origlen = skb->len;
8dc41944741596 Herbert Xu               2007-02-04  2198  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2199  	if (pskb_trim(skb, snaplen))
^1da177e4c3f41 Linus Torvalds           2005-04-16  2200  		goto drop_n_acct;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2201  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2202  	skb_set_owner_r(skb, sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2203  	skb->dev = NULL;
adf30907d63893 Eric Dumazet             2009-06-02  2204  	skb_dst_drop(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2205  
84531c24f27b02 Phil Oester              2005-07-12  2206  	/* drop conntrack reference */
895b5c9f206eb7 Florian Westphal         2019-09-29  2207  	nf_reset_ct(skb);
84531c24f27b02 Phil Oester              2005-07-12  2208  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2209  	spin_lock(&sk->sk_receive_queue.lock);
ee80fbf301adac Daniel Borkmann          2013-04-19  2210  	po->stats.stats1.tp_packets++;
3bc3b96f3b455b Eyal Birger              2015-03-01  2211  	sock_skb_set_dropcount(sk, skb);
27942a15209f56 Martin KaFai Lau         2022-03-02  2212  	skb_clear_delivery_time(skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2213  	__skb_queue_tail(&sk->sk_receive_queue, skb);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2214  	spin_unlock(&sk->sk_receive_queue.lock);
676d23690fb62b David S. Miller          2014-04-11  2215  	sk->sk_data_ready(sk);
^1da177e4c3f41 Linus Torvalds           2005-04-16  2216  	return 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2217  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2218  drop_n_acct:
8e8e2951e30957 Eric Dumazet             2019-06-12  2219  	atomic_inc(&po->tp_drops);
7091fbd82cd568 Willem de Bruijn         2011-09-30  2220  	atomic_inc(&sk->sk_drops);
2f57dd94bdef08 Yan Zhai                 2023-12-04  2221  	drop_reason = SKB_DROP_REASON_PACKET_SOCK_ERROR;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2222  
^1da177e4c3f41 Linus Torvalds           2005-04-16  2223  drop_n_restore:
^1da177e4c3f41 Linus Torvalds           2005-04-16  2224  	if (skb_head != skb->data && skb_shared(skb)) {
^1da177e4c3f41 Linus Torvalds           2005-04-16  2225  		skb->data = skb_head;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2226  		skb->len = skb_len;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2227  	}
^1da177e4c3f41 Linus Torvalds           2005-04-16  2228  drop:
6def5ba6ef15af Yan Zhai                 2024-05-30 @2229  	kfree_skb_for_sk(skb, sk, drop_reason);
                                                                                      ^^

^1da177e4c3f41 Linus Torvalds           2005-04-16  2230  	return 0;
^1da177e4c3f41 Linus Torvalds           2005-04-16  2231  }

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki