Re: [PATCH net v2] net/sched: add get_fill_size callbacks for actions missing them

[Simon Horman <horms@kernel.org>]

On Sun, Aug 16, 2026 at 05:13:27PM -0300, Victor Nogueira wrote:
> Several tc actions - act_police, act_bpf, act_pedit, act_ife, act_sample,
> act_ct, act_ctinfo and act_tunnel_key among them - provide no
> get_fill_size() callback, so tcf_action_fill_size() falls back to
> tcf_action_shared_attrs_size() which does not account for the
> action-specific netlink attributes emitted inside TCA_ACT_OPTIONS by
> their dump functions.
> 
> When an RTM_NEWACTION request with NLM_F_ECHO (or an RTNLGRP_TC
> listener) creates several actions, tcf_add_notify_msg() allocates the
> echo skb from this underestimated size. When this happens, the act_api
> code fails to add all of the fields to the netlink message and, thus,
> fails to send it. Issue is that, when that happens, this failure doesn't
> stop the action instances from being added. So any user watching these
> events will be under the false impression that no actions were created at
> all.
> 
> For example, act_pedit overruns with 32 actions of four munge keys each,
> act_police with 32 policers once the optional rate/peakrate/result/avrate
> attributes are present.
> 
> To fix this, add the missing get_fill_size callbacks returning the
> worst-case size of each action's dump attributes, following the pattern
> used by act_gact/act_skbedit/act_vlan. Also widen the TCA_GACT_TM
> accounting in tcf_action_shared_attrs_size() to nla_total_size_64bit(),
> since actions dump their tcf_t with nla_put_64bit(), which may be
> preceded by an NLA_PAD attribute.
> 
> Note: We only provided fixes for the actions we reproduced this bug with
> as of today. We can send a separate hardening patch for the remaining
> actions to net-next later. The other pre-existing issues, pointed out by
> Clashiko [1], will be fixed in upcoming patches.
> 
> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260810164357.1653956-1-victor%40mojatatu.com
> 
> Fixes: 4e76e75d6aba ("net sched actions: calculate add/delete event message size")
> Reported-by: Vega <vega@nebusec.ai>
> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Victor Nogueira <victor@mojatatu.com>
> ---
> v1 -> v2:
> - Use tcf_lock when accessing shared bpf action fields
> - Improve commit message clarifying what the bug actually affects - Jakub
> - Make it explicit that the list of actions missing get_fill_size() is
>   not exhaustive

Reviewed-by: Simon Horman <horms@kernel.org>