From: Peilin Ye <peilin.ye@xxxxxxxxxxxxx> [ Upstream commit 024ee930cb3c9ae49e4266aee89cfde0ebb407e1 ] Traffic redirected by bpf_redirect_peer() (used by recent CNIs like Cilium) is not accounted for in the RX stats of supported devices (that is, veth and netkit), confusing user space metrics collectors such as cAdvisor [0], as reported by Youlun. Fix it by calling dev_sw_netstats_rx_add() in skb_do_redirect(), to update RX traffic counters. Devices that support ndo_get_peer_dev _must_ use the @tstats per-CPU counters (instead of @lstats, or @dstats). To make this more fool-proof, error out when ndo_get_peer_dev is set but @tstats are not selected. [0] Specifically, the "container_network_receive_{byte,packet}s_total" counters are affected. Fixes: 9aa1206e8f48 ("bpf: Add redirect_peer helper") Reported-by: Youlun Zhang <zhangyoulun@xxxxxxxxxxxxx> Signed-off-by: Peilin Ye <peilin.ye@xxxxxxxxxxxxx> Co-developed-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> Reviewed-by: Nikolay Aleksandrov <razor@xxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20231114004220.6495-6-daniel@xxxxxxxxxxxxx Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx> Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/core/dev.c | 8 ++++++++ net/core/filter.c | 1 + 2 files changed, 9 insertions(+) --- a/net/core/dev.c +++ b/net/core/dev.c @@ -9995,6 +9995,14 @@ static int netdev_do_alloc_pcpu_stats(st { void __percpu *v; + /* Drivers implementing ndo_get_peer_dev must support tstat + * accounting, so that skb_do_redirect() can bump the dev's + * RX stats upon network namespace switch. + */ + if (dev->netdev_ops->ndo_get_peer_dev && + dev->pcpu_stat_type != NETDEV_PCPU_STAT_TSTATS) + return -EOPNOTSUPP; + switch (dev->pcpu_stat_type) { case NETDEV_PCPU_STAT_NONE: return 0; --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2491,6 +2491,7 @@ int skb_do_redirect(struct sk_buff *skb) net_eq(net, dev_net(dev)))) goto out_drop; skb->dev = dev; + dev_sw_netstats_rx_add(dev, skb->len); return -EAGAIN; } return flags & BPF_F_NEIGH ? Patches currently in stable-queue which might be from daniel@xxxxxxxxxxxxx are queue-6.1/tcp_bpf-fix-the-sk_mem_uncharge-logic-in-tcp_bpf_sen.patch queue-6.1/bpf-fix-dev-s-rx-stats-for-bpf_redirect_peer-traffic.patch queue-6.1/bpf-remove-unnecessary-kfree-im_node-in-lpm_trie_upd.patch queue-6.1/bpf-fix-helper-writes-to-read-only-maps.patch queue-6.1/net-move-l-t-d-stats-allocation-to-core-and-convert-veth-vrf.patch queue-6.1/veth-use-tstats-per-cpu-traffic-counters.patch queue-6.1/bpf-handle-bpf_exist-and-bpf_noexist-for-lpm-trie.patch queue-6.1/tools-override-makefile-arch-variable-if-defined-but.patch