Re: [PATCH net] net/sched: add get_fill_size callbacks for actions missing them

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 10 Aug 2026 13:43:57 -0300 Victor Nogueira wrote:
> When an RTM_NEWACTION request with NLM_F_ECHO (or an RTNLGRP_TC
> listener) creates several actions, tcf_add_notify_msg() allocates the
> echo skb from this underestimated size. act_bpf is the clearest case:
> TCA_ACT_BPF_OPS alone reaches 32KB per action (BPF_MAXINSNS), so two
> actions are enough to overrun the allocation. act_pedit overruns with
> 32 actions of four munge keys each,

"overruns" makes it sounds like we overflow a buffer.
AFAICT we'd at worse hit a WARN somewhere due to EMSGSIZE?

> act_police with 32 policers once the
> optional rate/peakrate/result/avrate attributes are present, and
> act_tunnel_key with a single action carrying a maximum-sized geneve
> option blob, whose 63 class/type/data attribute triplets expand to about
> 1.2KB. tca_get_fill() then fails and the request returns -EINVAL, but
> tcf_action_init() has already committed the actions via
> tcf_idr_insert_many(), so they stay installed even though userspace is
> told the request failed.

Please TAL at Clashiko review. 

One thing that'd be good to clarify is which WARN gets hit (if my
assumption is correct that it's a WARN) and that the path where it
hits has a lock covering the get_size and the rest of the operation.