[PATCH net] net: don't touch dev->stats in BPF redirect paths

[PATCH net] net: don't touch dev->stats in BPF redirect paths

[Jakub Kicinski]

Gal reports that BPF redirect increments dev->stats.tx_errors
on failure. This is not correct, most modern drivers completely
ignore dev->stats so these drops will be invisible to the user.
Core code should use the dedicated core stats which are folded
into device stats in dev_get_stats().

Reported-by: Gal Pressman <gal@nvidia.com>
Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com
Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: ast@kernel.org
CC: daniel@iogearbox.net
CC: andrii@kernel.org
CC: martin.lau@linux.dev
CC: eddyz87@gmail.com
CC: song@kernel.org
CC: yonghong.song@linux.dev
CC: john.fastabend@gmail.com
CC: kpsingh@kernel.org
CC: sdf@fomichev.me
CC: haoluo@google.com
CC: jolsa@kernel.org
CC: dsahern@gmail.com
CC: bpf@vger.kernel.org
---
 net/core/filter.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 616e0520a0bb..2c21735798a5 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2289,12 +2289,12 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
 
 	err = bpf_out_neigh_v6(net, skb, dev, nh);
 	if (unlikely(net_xmit_eval(err)))
-		DEV_STATS_INC(dev, tx_errors);
+		dev_core_stats_tx_dropped_inc(dev);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out_xmit;
 out_drop:
-	DEV_STATS_INC(dev, tx_errors);
+	dev_core_stats_tx_dropped_inc(dev);
 	kfree_skb(skb);
 out_xmit:
 	return ret;
@@ -2396,12 +2396,12 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
 
 	err = bpf_out_neigh_v4(net, skb, dev, nh);
 	if (unlikely(net_xmit_eval(err)))
-		DEV_STATS_INC(dev, tx_errors);
+		dev_core_stats_tx_dropped_inc(dev);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out_xmit;
 out_drop:
-	DEV_STATS_INC(dev, tx_errors);
+	dev_core_stats_tx_dropped_inc(dev);
 	kfree_skb(skb);
 out_xmit:
 	return ret;
-- 
2.52.0

Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

[Martin KaFai Lau]

On 1/28/26 8:10 AM, Jakub Kicinski wrote:
> Gal reports that BPF redirect increments dev->stats.tx_errors
> on failure. This is not correct, most modern drivers completely
> ignore dev->stats so these drops will be invisible to the user.
> Core code should use the dedicated core stats which are folded
> into device stats in dev_get_stats().

Acked-by: Martin KaFai Lau <martin.lau@kernel.org>

Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

[Gal Pressman]

On 28/01/2026 18:10, Jakub Kicinski wrote:
> Gal reports that BPF redirect increments dev->stats.tx_errors
> on failure. This is not correct, most modern drivers completely
> ignore dev->stats so these drops will be invisible to the user.
> Core code should use the dedicated core stats which are folded
> into device stats in dev_get_stats().
> 
> Reported-by: Gal Pressman <gal@nvidia.com>
> Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com
> Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Aha, this kinda makes my mlx5 fix redundant.
I'm debating whether I should send a revert?

> diff --git a/net/core/filter.c b/net/core/filter.c
> index 616e0520a0bb..2c21735798a5 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -2289,12 +2289,12 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
>  
>  	err = bpf_out_neigh_v6(net, skb, dev, nh);
>  	if (unlikely(net_xmit_eval(err)))
> -		DEV_STATS_INC(dev, tx_errors);
> +		dev_core_stats_tx_dropped_inc(dev);

The commit message didn't mention anything about changing tx_errors to
tx_dropped.

Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

[Daniel Borkmann]

On 1/28/26 5:10 PM, Jakub Kicinski wrote:
> Gal reports that BPF redirect increments dev->stats.tx_errors
> on failure. This is not correct, most modern drivers completely
> ignore dev->stats so these drops will be invisible to the user.
> Core code should use the dedicated core stats which are folded
> into device stats in dev_get_stats().
> 
> Reported-by: Gal Pressman <gal@nvidia.com>
> Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com
> Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Re: [PATCH net] net: don't touch dev->stats in BPF redirect paths

[Jakub Kicinski]

On Thu, 29 Jan 2026 09:45:10 +0200 Gal Pressman wrote:
> On 28/01/2026 18:10, Jakub Kicinski wrote:
> > Gal reports that BPF redirect increments dev->stats.tx_errors
> > on failure. This is not correct, most modern drivers completely
> > ignore dev->stats so these drops will be invisible to the user.
> > Core code should use the dedicated core stats which are folded
> > into device stats in dev_get_stats().
> > 
> > Reported-by: Gal Pressman <gal@nvidia.com>
> > Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com
> > Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>  
> 
> Aha, this kinda makes my mlx5 fix redundant.
> I'm debating whether I should send a revert?

Up to you, it doesn't hurt.
I guess the main reason to revert would be to catch similar bugs 
in the future, given the popularity of mlx5, but up to you if
you want to be exposed to such bugs :)

> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 616e0520a0bb..2c21735798a5 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -2289,12 +2289,12 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
> >  
> >  	err = bpf_out_neigh_v6(net, skb, dev, nh);
> >  	if (unlikely(net_xmit_eval(err)))
> > -		DEV_STATS_INC(dev, tx_errors);
> > +		dev_core_stats_tx_dropped_inc(dev);  
> 
> The commit message didn't mention anything about changing tx_errors to
> tx_dropped.

Fair, let me respin with a note.