[PATCH net v2 0/4] net/sched: cls_route: fix bucket retention and handle recomputation

[Victor Nogueira <victor@mojatatu.com>]

Patch 1 is the v1 patch, unchanged. route4_change() can move an existing
filter to a different top-level bucket, since route4_set_parms()
recomputes the handle from TCA_ROUTE4_TO/FROM/IIF. The filter is
unlinked from the old bucket, but the bucket itself is never freed once
it goes empty, so route4_delete() keeps reporting *last=false after the
last live filter is gone. That pins the empty tcf_proto and leaks it.
The filters linked to a bucket are refcounted now, and the bucket is
dropped from head->table[] as soon as the count reaches zero.

Reviewing v1, Sashiko pointed out that the duplicate scan in
route4_set_parms() compares against the wrong handle [1]. Patches 2 and
3 fix the two symptoms of that.

Patch 2 makes the scan compare against nhandle. f->handle is the handle
the filter has before the update, not the one it is about to be linked
under, so a change that moves a filter into a chain already holding
nhandle misses the collision and links a second filter under the same
handle. The newcomer is then unreachable: route4_get() returns the
incumbent, and route4_classify() stops at the first filter whose f->id
matches.

Patch 3 handles the mirror case. An in-place replace computes an nhandle
that the filter being replaced already carries, so the scan finds that
filter and rejects the request with -EEXIST. The older filter is passed
to route4_set_parms() and skipped in the scan. Skipping it alone would
rename the filter it replaces: the 0x7F00 order bits are carried in no
attribute and were folded into nhandle on the create path alone, so an
order 1 filter came back as order 0, and a sibling sharing its key could
then no longer be replaced at all. They are carried over now whenever
the request builds the key the filter already has, which leaves a
request that does change the key renaming the filter as before.

Patch 4 adds tdc coverage for all three, including the cross-bucket move
case Sashiko noted route.json had no test for.

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com

v1 -> v2:
  - Added patches 2, 3 and 4. Patch 1 is unchanged.

Victor Nogueira (4):
  net/sched: cls_route: free emptied bucket on filter move
  net/sched: cls_route: Reject handle aliasing
  net/sched: cls_route: Fix in-place replace
  selftests/tc-testing: Add cls_route bucket move and change tests

 net/sched/cls_route.c                         |  76 ++++---
 .../tc-testing/tc-tests/filters/route.json    | 210 ++++++++++++++++++
 2 files changed, 249 insertions(+), 37 deletions(-)

-- 
2.55.0