From nobody Fri Sep 25 19:19:15 2026 Received: from mta0.migadu.com (out-42.mta0.migadu.com [91.218.175.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B51DD3C8C71 for ; Wed, 9 Sep 2026 07:04:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788937460; cv=none; b=prk9ENhVQx9R8wP3HY9Aoxe/DjE7Vnw1Cyigy6XjACF9PeBHhvSIiHPVZWBRT0hjF/0XAyqBz2ox2a+lw2HnApBd5AMYHigH3CMQBDckssTVR9HzkUNGQp6/7bXnlnSujki3AE2YvLfKbP0tru9nuRr2022z3e37SAa6clw25pc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788937460; c=relaxed/simple; bh=T6lie9elNQONzQUM6lpEByBCQyx9hgQM9lLk5pi6gO4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kMflLbfw4pAoIbW9zZe1Lx6XiZ40xAymszgaS9Hzzv0UUPG+BHTzCWyKw1LZEZusEyYhzJ4EmrCt44eVEFHMSisGbBCIdsN7o/FIzdSapAhMqSKVddXls6d87GYo4EEpj9OxpSsljKo7Lm/M0ha7H7ZtuWT5xqNZ4RoQXBMxqIM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=N37lVx5B; arc=none smtp.client-ip=91.218.175.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="N37lVx5B" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=T6lie9elNQONzQUM6lpEByBCQyx9hgQM9lLk5pi6gO4=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788937456; v=1; x=1789542256; b=N37lVx5ByPLtwf34oE7jKgfe1KDMS1uDMqmwhuY9ZA82XlkB9NMSVSNO4y1mGmeR5MPZYf5L ANTKDZ1AE11RzztNQp7/3gOf/b7M3xnWcaH2zVXhu8t0hDF9IlS7WWmZN29SPiAhg7mxWZR23em FXMCOSVnOSFNY0mefTOE5Dys= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id da7b0975fc924df2; Wed, 09 Sep 2026 07:04:16 +0000 X-Mizu-Trace-ID: da7b0975fc924df2 X-Migadu-Flow: FLOW_OUT From: Xuanqiang Luo To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, shuah@kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Xuanqiang Luo , stable@vger.kernel.org Subject: [PATCH net v1 1/2] net/sched: act_api: release all action references on NEWACTION failure Date: Wed, 9 Sep 2026 15:03:35 +0800 Message-ID: <20260909070336.32979-2-xuanqiang.luo@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909070336.32979-1-xuanqiang.luo@linux.dev> References: <20260909070336.32979-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo When a batched RTM_NEWACTION request replaces an existing action, tcf_idr_check_alloc() takes a temporary reference on it. If a later action fails to initialize, tcf_action_destroy() uses strict release semantics to clean up the actions initialized so far. For an action bound to a filter, the strict check returns -EPERM without dropping the temporary reference. This error also makes tcf_action_destroy() return before releasing subsequent entries. Any new action initialized between the bound action and the failing entry is leaked together with its reserved IDR slot, preventing reuse of its index. Use tcf_idr_release() to drop each reference held by the batch without rejecting bound actions. This allows cleanup to continue through all initialized entries and preserves the module reference release when an action is destroyed. Explicit action deletion and flushing retain their separate bind-count checks. Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside= ") Cc: stable@vger.kernel.org Signed-off-by: Xuanqiang Luo Reviewed-by: Jamal Hadi Salim --- net/sched/act_api.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 37eced84dfa5f..19501dc994641 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -1200,18 +1200,13 @@ EXPORT_SYMBOL(tcf_action_exec); =20 int tcf_action_destroy(struct tc_action *actions[], int bind) { - const struct tc_action_ops *ops; struct tc_action *a; int ret =3D 0, i; =20 tcf_act_for_each_action(i, a, actions) { actions[i] =3D NULL; - ops =3D a->ops; - ret =3D __tcf_idr_release(a, bind, true); - if (ret =3D=3D ACT_P_DELETED) - module_put(ops->owner); - else if (ret < 0) - return ret; + /* Drop our reference even if the action is still bound to a filter. */ + ret =3D tcf_idr_release(a, bind); } return ret; } --=20 2.43.0 From nobody Fri Sep 25 19:19:15 2026 Received: from mta0.migadu.com (out-51.mta0.migadu.com [91.218.175.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCBAD3C8C71 for ; Wed, 9 Sep 2026 07:04:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788937473; cv=none; b=i+qKXeEBTG+PIrKQ36U07Smq0Qag7H+4uOuoumec8Bzf7v831GRCyLUmALXsf1D1QxTj7akE3IMRZ7qXmLXBVxvnigmK6WAim+BHPZvas2eBKzUlN7tOeFAkGgEPOSVTmu060YaWZzQO9XBCmKPR7aAjEA1TCfZZewPszIFvQG0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788937473; c=relaxed/simple; bh=//yohNIuqAnGRo3lgqQJ49CeHC5XJjYRMg3X/WB18PA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=plftbm2ZGbnarROdazmg9HxxtcQ1oyNqeShc9MU0Jf1qL6ZguFcSLTaIvaWC7tcfp4lezSflECzPutoRtydb1ruW1SFTxCJPJB2JHOORzhiiK0i0A4V/X1VT2h0kquk8OMyssjtrITGtiG9IMUxddhsA/rbAb0hH/HdKHf6Tsow= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=uTnVHdOY; arc=none smtp.client-ip=91.218.175.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="uTnVHdOY" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=//yohNIuqAnGRo3lgqQJ49CeHC5XJjYRMg3X/WB18PA=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788937468; v=1; x=1789542268; b=uTnVHdOYYKCg2HalMo60hJAgJH66QhFjVANiweZ9e05v510y3hWnmtw7kpau0HJvV0jp57cc wGxXuilLiVpdvfEXmyyWVPopaXH0Tp0iVa0RQr2kaSgf/0zuGz9464XJZaUVNFX56tpagjYhOUj YrRv0xdIjDcABaeZKqAN0rdQ= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id b6175bb5234216f3; Wed, 09 Sep 2026 07:04:28 +0000 X-Mizu-Trace-ID: b6175bb5234216f3 X-Migadu-Flow: FLOW_OUT From: Xuanqiang Luo To: netdev@vger.kernel.org Cc: jhs@mojatatu.com, jiri@resnulli.us, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, shuah@kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Xuanqiang Luo Subject: [PATCH net v1 2/2] selftests: tc-testing: test action batch failure cleanup Date: Wed, 9 Sep 2026 15:03:36 +0800 Message-ID: <20260909070336.32979-3-xuanqiang.luo@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909070336.32979-1-xuanqiang.luo@linux.dev> References: <20260909070336.32979-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo Add tests for cleanup after a batched RTM_NEWACTION request fails. Replace an existing gact action bound to a filter, then fail a later entry by requesting goto chain without a classifier context. Check that the bound action's reference count returns to its original value. Also cover a successfully initialized new action between the bound action and the failing entry, verifying that its reserved index can be reused. Repeat the bound action in another batch to check that each temporary reference to the same action is released. Signed-off-by: Xuanqiang Luo Reviewed-by: Jamal Hadi Salim --- .../tc-tests/actions/gact-rollback.json | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/gac= t-rollback.json diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollb= ack.json b/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollbac= k.json new file mode 100644 index 0000000000000..e92a4180db689 --- /dev/null +++ b/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json @@ -0,0 +1,78 @@ +[ + { + "id": "e3b1", + "name": "Failed action batch releases a bound action reference", + "category": [ + "actions", + "gact" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$TC qdisc add dev $DEV1 ingress", + "$TC actions add action pass index 1", + "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall= action gact index 1" + ], + "cmdUnderTest": "$TC actions replace action pass index 1 action go= to chain 42 index 3", + "expExitCode": "255", + "verifyCmd": "$TC actions ls action gact", + "matchPattern": "total acts 1.*index 1 ref 2 bind 1", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DEV1 ingress" + ] + }, + { + "id": "e3b2", + "name": "Failed action batch releases entries after a bound action= ", + "category": [ + "actions", + "gact" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$TC qdisc add dev $DEV1 ingress", + "$TC actions add action pass index 1", + "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall= action gact index 1", + [ + "$TC actions replace action pass index 1 action pass index= 2 action goto chain 42 index 3", + 255 + ] + ], + "cmdUnderTest": "$TC actions add action pass index 2", + "expExitCode": "0", + "verifyCmd": "$TC actions ls action gact", + "matchPattern": "total acts 2.*index 1 ref 2 bind 1.*index 2 ref 1= bind 0", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DEV1 ingress" + ] + }, + { + "id": "e3b3", + "name": "Failed action batch releases repeated references to a bou= nd action", + "category": [ + "actions", + "gact" + ], + "plugins": { + "requires": "nsPlugin" + }, + "setup": [ + "$TC qdisc add dev $DEV1 ingress", + "$TC actions add action pass index 1", + "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall= action gact index 1" + ], + "cmdUnderTest": "$TC actions replace action pass index 1 action pa= ss index 1 action goto chain 42 index 3", + "expExitCode": "255", + "verifyCmd": "$TC actions ls action gact", + "matchPattern": "total acts 1.*index 1 ref 2 bind 1", + "matchCount": "1", + "teardown": [ + "$TC qdisc del dev $DEV1 ingress" + ] + } +] --=20 2.43.0