Re: [PATCH net 1/2] net/sched: act_api: inherit filter offload flags only on new actions

[Simon Horman <horms@kernel.org>]

On Wed, Oct 21, 2026 at 09:32:18PM +0200, Alexandre Cassen wrote:
> tcf_action_init() gives the skip_sw and skip_hw flags of a filter to the
> actions it binds. An action that another filter created gets them too,
> they then apply to every filter that uses this action. When a
> skip_sw filter reuses the action of a software filter, the software
> filter silently stops running it. This happens even when the filter add
> fails on a later action. A skip_hw filter likewise prevents a later
> filter without flags from reusing the action.
> 
> Give the flags only to the actions that the filter creates. The mismatch
> check still rejects a filter that reuses an action with a flag that the
> filter does not have.
> 
> Discovered by manual code inspection after the Sashiko AI review [1] of
> a tunnel_key patch questioned how actions get the filter flags.
> Reproduced on netdevsim without kernel changes. The egress filter below
> runs in software only, since netdevsim offloads only ingress filters.
> Once the skip_sw filter reuses its drop action, the last command shows
> skip_sw on this action and the egress filter stops dropping packets:
> 
>   ethtool -K eth0 hw-tc-offload on
>   tc qdisc add dev eth0 clsact
>   tc filter add dev eth0 egress protocol ip flower dst_ip 192.0.2.1 \
>      action gact drop index 1
>   tc filter add dev eth0 ingress protocol ip flower skip_sw \
>      dst_ip 192.0.2.2 action gact drop index 1
>   tc actions get action gact index 1
> 
> Tested with the reproducer and the tc-testing action, matchall and
> flower tests.
> 
> Fixes: 34d35b4edbbe ("net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers")
> Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009051930.3619697-1-acassen%40corp.free.fr [1]
> Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>

Reviewed-by: Simon Horman <horms@kernel.org>