Merge branch 'net-sched-fix-action-batch-deletion-cleanup'

Xuanqiang Luo says:

====================
net/sched: fix action batch deletion cleanup

Batched RTM_DELACTION requests can leak references to unprocessed actions
when deletion stops at a filter-bound action.

Patch 1 fixes the failure cleanup.

Patch 2 adds tc-testing regression coverage.

Failure reproduction (key output excerpts):

  python3 tdc.py -f /root/tc-testing/batch-delete.json

not ok 1 d710 - Release tail references after first action deletion fails
	Could not match regex pattern. Verify command output:
[...]
	 index 2 ref 2 bind 0
[...]
	 index 3 ref 2 bind 0

not ok 2 d711 - Release tail references after middle action deletion fails
	Could not match regex pattern. Verify command output:
[...]
	 index 3 ref 2 bind 0

not ok 3 d713 - Delete a tail action once after a failed batch
	Could not match regex pattern. Verify command output:
total acts 2
[...]
	 index 2 ref 1 bind 0
====================

Link: https://patch.msgid.link/20260910093413.34509-1-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-09-15 17:03:13 -07:00
commit 562219874c
2 changed files with 123 additions and 3 deletions

View File

@ -1218,11 +1218,16 @@ static int tcf_action_put(struct tc_action *p)
static void tcf_action_put_many(struct tc_action *actions[])
{
struct tc_action *a;
int i;
tcf_act_for_each_action(i, a, actions) {
const struct tc_action_ops *ops = a->ops;
/* Deletion may have cleared entries before failing. */
for (i = 0; i < TCA_ACT_MAX_PRIO; i++) {
struct tc_action *a = actions[i];
const struct tc_action_ops *ops;
if (!a)
continue;
ops = a->ops;
if (tcf_action_put(a))
module_put(ops->owner);
}

View File

@ -0,0 +1,115 @@
[
{
"id": "d710",
"name": "Release tail references after first action deletion fails",
"category": [
"actions",
"gact"
],
"plugins": {
"requires": "nsPlugin"
},
"setup": [
[
"$TC actions flush action gact",
0,
1,
255
],
"$TC qdisc add dev $DEV1 ingress",
"$TC actions add action pass index 1",
"$TC actions add action pass index 2",
"$TC actions add action pass index 3",
"$TC filter add dev $DEV1 protocol ip ingress u32 match u32 0 0 action gact index 1"
],
"cmdUnderTest": "$TC actions del action gact index 1 action gact index 2 action gact index 3",
"expExitCode": "255",
"verifyCmd": "$TC actions ls action gact",
"matchPattern": "total acts 3\\b.*index 1 ref 2 bind 1\\b.*index 2 ref 1 bind 0\\b.*index 3 ref 1 bind 0\\b",
"matchCount": "1",
"teardown": [
"$TC qdisc del dev $DEV1 ingress",
[
"$TC actions flush action gact",
0,
1,
255
]
]
},
{
"id": "d711",
"name": "Release tail references after middle action deletion fails",
"category": [
"actions",
"gact"
],
"plugins": {
"requires": "nsPlugin"
},
"setup": [
[
"$TC actions flush action gact",
0,
1,
255
],
"$TC qdisc add dev $DEV1 ingress",
"$TC actions add action pass index 1",
"$TC actions add action pass index 2",
"$TC actions add action pass index 3",
"$TC filter add dev $DEV1 protocol ip ingress u32 match u32 0 0 action gact index 2"
],
"cmdUnderTest": "$TC actions del action gact index 1 action gact index 2 action gact index 3",
"expExitCode": "255",
"verifyCmd": "$TC actions ls action gact",
"matchPattern": "total acts 2\\b.*index 2 ref 2 bind 1\\b.*index 3 ref 1 bind 0\\b",
"matchCount": "1",
"teardown": [
"$TC qdisc del dev $DEV1 ingress",
[
"$TC actions flush action gact",
0,
1,
255
]
]
},
{
"id": "d713",
"name": "Delete a tail action once after a failed batch",
"category": [
"actions",
"gact"
],
"plugins": {
"requires": "nsPlugin"
},
"setup": [
[
"$TC actions flush action gact",
0,
1,
255
],
"$TC qdisc add dev $DEV1 ingress",
"$TC actions add action pass index 1",
"$TC actions add action pass index 2",
"$TC filter add dev $DEV1 protocol ip ingress u32 match u32 0 0 action gact index 1"
],
"cmdUnderTest": "$TC actions del action gact index 1 action gact index 2",
"expExitCode": "255",
"verifyCmd": "sh -c '$TC actions del action gact index 2 && $TC actions ls action gact'",
"matchPattern": "total acts 1\\b.*index 1 ref 2 bind 1\\b",
"matchCount": "1",
"teardown": [
"$TC qdisc del dev $DEV1 ingress",
[
"$TC actions flush action gact",
0,
1,
255
]
]
}
]