Re: [PATCH net-next v3 1/5] net/sched: act_gate: reject oversized dumps instead of wrapping them

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] net/sched: missing error propagation and wrong extack in tcf_get_notify
--

commit 98a2c073503c58fa744586844b669ba5ddd1bfc0
Author: Jamal Hadi Salim <jhs@mojatatu.com>

net/sched: act_gate: reject oversized dumps instead of wrapping them

This commit fixes an issue where oversized action dumps wrap their u16 nest
lengths, resulting in structurally corrupt netlink messages. It uses
nla_nest_end_safe() to report -EMSGSIZE instead, preventing unrepresentable
dumps from vetoing deletes and allowing correct handling.

Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com
Link: https://lore.kernel.org/netdev/QDISC-H19Z.v2.20261007062551@mojatatu.com/
Link: https://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/
Link: https://lore.kernel.org/netdev/179111893181.434549.13449660670267048994@kernel.org/

> diff --git a/net/sched/act_api.c b/net/sched/act_api.c
> index 6e48b4bc2d75d..4b4b5d37d2206 100644
> --- a/net/sched/act_api.c
> +++ b/net/sched/act_api.c

[ ... ]

> @@ -1701,7 +1719,7 @@ static int tca_get_fill(struct sk_buff *skb, struct tc_action *actions[],
>  
>  out_nlmsg_trim:
>  	nlmsg_trim(skb, b);
> -	return -1;
> +	return err;
>  }
>  
>  static int
>  tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
>  	       struct tc_action *actions[], size_t attr_size, int event,
>  	       struct netlink_ext_ack *extack)
>  {
>  	struct sk_buff *skb;
>  
>  	skb = alloc_skb(max(attr_size, NLMSG_GOODSIZE), GFP_KERNEL);
>  	if (!skb)
>  		return -ENOBUFS;
>  	if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, 0, event,
>  			 0, 1, NULL) <= 0) {
>  		NL_SET_ERR_MSG(extack, "Failed to fill netlink attributes while adding TC action");
>  		kfree_skb(skb);
>  		return -EINVAL;
>  	}

[Severity: Low]
Since tca_get_fill() now returns actual error codes like -EMSGSIZE instead of
just -1, shouldn't tcf_get_notify() also be updated to propagate these errors?

If an oversized RTM_GETACTION request fails with -EMSGSIZE, it appears it
will incorrectly return -EINVAL to userspace and display an inaccurate
extack message ("while adding TC action").

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/QDISC-H19Z.v3.r0.20261012193813@mojatatu.com?part=1