net/sched: act_mirred: account for TCA_MIRRED_BLOCKID in get_fill_size

tcf_mirred_get_fill_size budgets only TCA_MIRRED_PARMS, but
tcf_mirred_dump also emits TCA_MIRRED_BLOCKID whenever the action was
created with a block instead of a device, so the budget falls 8 bytes
short of what the dump may produce for such actions.

Account for TCA_MIRRED_BLOCKID unconditionally: reading tcfm_blockid to
size it conditionally would race a concurrent replace, which can flip the
action between device and block between sizing and dumping.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com
Co-developed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/QDISC-RYTB.v1.20260918093205@mojatatu.com.1
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Victor Nogueira 2026-09-19 20:04:27 -03:00 committed by Paolo Abeni
parent 10cfa109c8
commit f09db8b83e

View File

@ -607,7 +607,8 @@ tcf_mirred_get_dev(const struct tc_action *a,
static size_t tcf_mirred_get_fill_size(const struct tc_action *act)
{
return nla_total_size(sizeof(struct tc_mirred));
return nla_total_size(sizeof(struct tc_mirred)) /* TCA_MIRRED_PARMS */
+ nla_total_size(sizeof(u32)); /* TCA_MIRRED_BLOCKID */
}
static void tcf_offload_mirred_get_dev(struct flow_action_entry *entry,