retis-org / retis

Tracing packets in the Linux networking stack & friends
https://retis.readthedocs.io/en/stable/
100 stars 14 forks source link

Properly handle non-Ethernet frames and not-supported ethertypes #428

Closed amorenoz closed 1 month ago

amorenoz commented 2 months ago

We've seen non-Ethernet packets in retis:

e.g:

48678778241154 (0) [irq/175-iwlwifi] 1669 [tp] skb:kfree_skb drop (reason mac80211_monitor/RX_DROP_MONITOR)                                                                                                         
    bpf_prog_be31ae23198a0378_sd_devices+0x3f744                                                                                                                                                                     
    bpf_prog_be31ae23198a0378_sd_devices+0x3f744                                                                                                                                                                     
    bpf_trace_run3+0x8b                                                                                                                                                                                              
    kfree_skb_reason+0x8b                                                                                                                                                                                            
    ieee80211_rx_handlers+0x2b8                                                                                                                                                                                      
    ieee80211_prepare_and_rx_handle+0x862                                                                                                                                                                            
    ieee80211_rx_list+0x9b3                                                                                                                                                                                          
    ieee80211_rx_napi+0x51                                                                                                                                                                                           
    iwl_mvm_rx_mpdu_mq+0xb08                                                                                                                                                                                         
    iwl_pcie_rx_handle+0x260                                                                                                                                                                                         
    iwl_pcie_napi_poll_msix+0x39                                                                                                                                                                                     
    __napi_poll+0x28                                                                                                                                                                                                 
    net_rx_action+0x2c6                                                                                                                                                                                              
    handle_softirqs+0xf4                                                                                                                                                                                             
    do_softirq.part.0+0x3b                                                                                                                                                                                           
    __local_bh_enable_ip+0x60                                                                                                                                                                                        
    iwl_pcie_irq_rx_msix_handler+0xd1                                                                                                                                                                                
    irq_thread_fn+0x20                                                                                                                                                                                               
    irq_thread+0x1b0                                                                                                                                                                                                 
    kthread+0xcf                                                                                                                                                                                                     
    ret_from_fork+0x31                                                                                                                                                                                               
    ret_from_fork_asm+0x1a                                 

Also, it's possible that the packet has a valid Ethernet header but the ethertype is not one of the few we support.

On both cases, the output is weird because the skb module will not print anything as reported here.

We should: