BPF List
 help / color / mirror / Atom feed
* [PATCH net-next v3 0/5] net/sched: reject oversized action dumps and cap unbounded entry lists
@ 2026-10-13  8:54 Jamal Hadi Salim
  2026-10-13  8:54 ` [PATCH net-next v3 1/5] net/sched: act_gate: reject oversized dumps instead of wrapping them Jamal Hadi Salim
  0 siblings, 1 reply; 4+ messages in thread
From: Jamal Hadi Salim @ 2026-10-13  8:54 UTC (permalink / raw)
  To: netdev
  Cc: Jamal Hadi Salim, Jiri Pirko, David S . Miller, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Victor Nogueira,
	Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
	Eduard Zingerman, Kumar Kartikeya Dwivedi, Martin KaFai Lau,
	Song Liu, Yonghong Song, Jiri Olsa, Emil Tsalapatis,
	Ihor Solodrai, John Fastabend, Stanislav Fomichev, bpf,
	Vinicius Costa Gomes, Vladimir Oltean, Vladimir Oltean,
	Paul Moses, Edward Adam Davis, Davide Caratti, sashiko-bot

An action dump is carried inside nested netlink attributes whose lengths
are u16. When a single action's dump does not fit, a plain nla_nest_end()
writes a wrapped length and the kernel hands userspace a corrupt reply; on
the classifier path the -EMSGSIZE this produces is mistaken for socket
buffer exhaustion and retried in a loop that can never succeed.

Patch 1 makes every nest an action dump can be carried in fail cleanly
(-EMSGSIZE) instead of wrapping, bounds the tfilter_notify_prep() retry,
and stops a notification that cannot be built from vetoing a filter or
action delete. Patch 2 stops an action add whose actions were already
committed from being reported as a failure when the notification cannot
be built. Patch 3 caps the number of gate scheduling entries at 1024,
rejected with -E2BIG and an extack message. Patch 4 caps the number of
taprio schedule entries at 1024 in the same way. Patch 5 makes the action
dump report an action that cannot be serialized into one dump skb as
-EMSGSIZE instead of returning success and silently dropping the rest of
the list.

Patches 3 and 4 each bound an unbounded userspace-supplied entry list that
a reviewer reading the gate cap would ask about next: the qdisc-side
sibling and the SJA1105 schedule-table producer. Patch 5 closes the
silent-truncation that the cap admits but cannot reach. They are folded
into this posting so the family is fixed in one patchset rather than a
stream of follow-ups; each stays a separate commit, so any one can drop
out without touching the others.

A pre-existing filter reference-count leak in cls_flower, found alongside
this work, is being sent to net as its own fix with a Fixes: tag; it is not
part of this series.

This patchset is a retarget from net to net-next of the previous posting:
https://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/
The wrapped-nla_len corruption this series addresses is not a regression of
commit cfa165cbfbed ("net/sched: act_gate: budget the per-entry list in
get_fill_size"): the enclosing action and filter nests antedate it and a
plain nla_nest_end() has always written the wrapped length at U16_MAX.

This is hardening, not a regression fix, so it targets net-next.

v1 -> v2:
  - Retarget to net-next and drop Fixes:/Cc: stable, as it is hardening
    rather than a regression.
  - Add the entry-count cap into the series as patch 2/2 (now 3/5), as the
    parent commit promised for net-next.  The cap value is 1024, grounded in the
    SJA1105 schedule-table capacity and the 16-bit netlink TLV boundary.
  - Patch 1: add seven additional action-capable classifier
    TCA_OPTIONS closes and correct the Conditions Kconfig name.
  - Sashiko review of that posting:
    https://sashiko.dev/#/patchset/QDISC-H19Z.v1.20261001053234%40mojatatu.com

v2 -> v3:
  - Patch 1: the action-delete path no longer lets an unbuildable
    RTM_DELACTION notification veto the delete.  tca_get_fill() and
    tcf_del_notify_msg() pass -EMSGSIZE up, and tcf_del_notify() drops the
    notification and proceeds with the delete.
  - Patch 1: the filter-delete path drops an unbuildable notification and
    proceeds with the delete; its "Filter deleted" extack is set only after
    ->delete() has returned 0.
  - Patch 1: the retry bound is documented as part of the same change as
    the checked closes, and -EMSGSIZE is noted as the general
    tcf_fill_node() outcome rather than a u16 overflow only.
  - Patch 2: the action-add path no longer reports a failure after the
    actions are committed.  tcf_action_add() drops a notification that
    cannot be built and returns success, so an RTM_NEWACTION that created
    its actions is no longer reported back as -EINVAL (mirrors
    tc_new_tfilter(), which never fails a filter create on a notify
    failure).
  - Sashiko reviews of v2:
    https://sashiko.dev/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com
    https://netdev-ai.bots.linux.dev/sashiko/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com
  - Fold the qdisc-side sibling into the series as patch 4/5: cap the
    taprio schedule entry list at 1024 (TAPRIO_ENTRIES_MAX) in
    parse_sched_list(), rejected with -E2BIG and an extack.  Same
    unbounded-entry-list family as the gate cap, grounded in the SJA1105
    schedule-table capacity, and a separate commit.
  - Fold the dump path into the series as patch 5/5: tcf_dump_walker() and
    tc_dump_action() now report an action that cannot be serialized into a
    dump skb as -EMSGSIZE (with an extack) instead of returning success and
    quietly dropping the rest of the list.  Reported and suggested by Paul
    Moses.

Jamal Hadi Salim (5):
  net/sched: act_gate: reject oversized dumps instead of wrapping them
  net/sched: act_api: keep an add that created its actions from failing
  net/sched: act_gate: cap the number of scheduling entries
  net/sched: sch_taprio: cap the number of schedule entries
  net/sched: act_api: report an oversized action dump instead of
    silently truncating it

 net/sched/act_api.c      | 87 ++++++++++++++++++++++++++++------------
 net/sched/act_gate.c     | 18 ++++++++-
 net/sched/cls_api.c      | 38 +++++++++++++-----
 net/sched/cls_basic.c    |  3 +-
 net/sched/cls_bpf.c      |  3 +-
 net/sched/cls_cgroup.c   |  3 +-
 net/sched/cls_flow.c     |  3 +-
 net/sched/cls_flower.c   |  6 ++-
 net/sched/cls_fw.c       |  3 +-
 net/sched/cls_matchall.c |  3 +-
 net/sched/cls_route.c    |  3 +-
 net/sched/cls_u32.c      |  3 +-
 net/sched/sch_taprio.c   | 14 +++++++
 13 files changed, 141 insertions(+), 46 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-14  9:57 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-13  8:54 [PATCH net-next v3 0/5] net/sched: reject oversized action dumps and cap unbounded entry lists Jamal Hadi Salim
2026-10-13  8:54 ` [PATCH net-next v3 1/5] net/sched: act_gate: reject oversized dumps instead of wrapping them Jamal Hadi Salim
2026-10-14  8:54   ` sashiko-bot
2026-10-14  9:56     ` Jamal Hadi Salim

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox