From 1a49567560a13bf9501eeafbbaa9414c2ff624ac Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Tue, 13 Oct 2026 04:54:28 -0400 Subject: [PATCH] net/sched: act_api: keep an add that created its actions from failing Spotted while fixing the dump sizing reported by Sashiko. This references commit cfa165cbfbed ("net/sched: act_gate: budget the per-entry list in get_fill_size"), which is only one way to trigger the issue. The issue: tcf_action_add() returns the result of tcf_add_notify(), so an RTM_NEWACTION is reported back to user space as a failure when the event notification cannot be built, even though tcf_action_init() has already inserted the actions into the idr. The realistic trigger is an action list whose TCA_ACT_TAB exceeds a u16 nest (the notification can never be built), or a memory-pressure -ENOBUFS from the notification's alloc_skb(). The Fix: Drop the notification failure on the add path: the created actions stay installed and the add reports success, with an extack noting that the event notification could not be sent. The extack is set on a successful ack, so iproute2 reports it as a warning; it replaces any warning tcf_action_init() left there. This needs no idr/refcount audit - tca_put_bound_many() already runs unconditionally after the notification, so this path releases exactly what the success path does and only the returned result changes. A create that ignores a notification failure is already the filter-side norm: tc_new_tfilter() does not look at tfilter_notify()'s result. This is net-next hardening: it corrects the reported result of an add that already took effect, not a regression. Conditions to recreate the bug: CONFIG_NET_CLS_ACT=y; CONFIG_NET_ACT_GATE=y. Send an RTM_NEWACTION whose actions create an aggregate TCA_ACT_TAB larger than a u16 nest, so the notification cannot be built; before this change the add reports -EINVAL although the actions were installed, after it the add reports success and the actions are present. Reported-by: Sashiko (nipa) Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com Reviewed-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-2@mojatatu.com Signed-off-by: Jakub Kicinski --- net/sched/act_api.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 6b751e274ce0..3737302275ae 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -2168,12 +2168,17 @@ static int tcf_action_add(struct net *net, struct nlattr *nla, if (ret < 0) return ret; - ret = tcf_add_notify(net, n, actions, portid, attr_size, extack); + /* The add has already been committed, so a notification failure + * must not turn it into a reported failure (cf. tc_new_tfilter()). + */ + if (tcf_add_notify(net, n, actions, portid, attr_size, extack)) + NL_SET_ERR_MSG(extack, + "Action created; event notification could not be sent"); /* only put bound actions */ tca_put_bound_many(actions, init_res); - return ret; + return 0; } static const struct nla_policy tcaa_policy[TCA_ROOT_MAX + 1] = {