Re: [PATCH net] net/sched: cls_api: reclaim an empty proto on the error path

[Simon Horman <horms@kernel.org>]

On Thu, Sep 24, 2026 at 04:32:49AM -0400, Jamal Hadi Salim wrote:
> Two racing tc filter add requests on the same chain/prio of an
> unlocked classifier both run change() on the shared proto and both
> can fail: the winner's tcf_chain_tp_delete_empty() attempt gives up
> because the loser's handle is still in the idr, and the loser's
> error path drops only its own reference without a second reclamation
> attempt. The empty proto stays linked in the chain, holding the
> chain reference, a block reference and the classifier module
> reference until the chain or block is torn down.
> 
> Reclaim the proto on the error path of any failed request that holds
> a proto reference. The reclamation is emptiness-gated:
> tcf_chain_tp_delete_empty() unlinks the proto only when
> delete_empty() admits it is empty, so a live shared proto is never
> unlinked. A proto the request created is reclaimed unconditionally -
> it is the only owner, so marking it for deletion is safe even without
> a delete_empty callback. Classifiers without one (the check marks the
> proto unconditionally) are rtnl-serialized, so the raced window this
> guard closes cannot arise for them.
> 
> This is a follow-up to commit d4e359b3608a ("net/sched: cls_api: fix
> teardown of an adopted proto on insert-race loss"), which stopped the
> loser of the insert race from unlinking the winner's live proto but
> left the empty-proto residual in place.
> 
> Conditions to recreate:
> - CONFIG_NET_CLS_FLOWER=y; veth pair
> - tc qdisc add dev veth0 ingress
> - two concurrent `tc filter add dev veth0 ingress protocol ip pref 1
>   flower skip_sw ... action drop` (both fail in fl_hw_replace_filter
>   after publishing their handle in the idr); repeat in a loop
> - an empty flower tp stays linked after both requests fail; visible
>   as a bare `filter protocol ip pref 1 flower chain 0` header in
>   `tc filter show` with no filter entries
> - CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)
> 
> Fixes: 8b64678e0af8 ("net: sched: refactor tp insert/delete for concurrent execution")
> Reported-by: Sashiko (nipa) <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260805134049.927864-1-victor@mojatatu.com
> Tested-by: hybris <hybris@mojatatu.ai>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

Reviewed-by: Simon Horman <horms@kernel.org>