Re: [PATCH net 1/2] net/sched: cls_route: reject change with no routing attribute

[Simon Horman <horms@kernel.org>]

On Thu, Oct 01, 2026 at 12:32:00PM -0300, Victor Nogueira wrote:
> route4_change on a filter change that supplies no routing attribute
> at all (no to/from/iif) reaches route4_set_parms with fold set, so the
> handle-mismatch check -- which only fires when creating -- is skipped.
> nhandle is built as the all-wildcard bucket (0x8000 | 0xFFFF << 16) and
> the filter is rekeyed to 0xFFFF8000, so the handle userspace already
> stored no longer addresses the filter. (The netlink reply carries the
> new handle; what goes stale is the handle the caller holds.)
> 
> The rekey actually misclassifies the packets. The new handle's from_hash
> is the wildcard chain (route4_hash_wild), whose filters route4_classify
> applies without any id/iif comparison, and its bucket (256) is reached
> by every packet through the h < 256 restart. A filter that matched only
> a specific realm therefore becomes an unconditional catch-all that applies
> its classid and actions to all otherwise-unmatched traffic.
> 
> Reject a change that would rekey the filter this way, with the
> routing-attributes-required error. A change that names at least one of
> to/from/iif, and an in-place replace that keeps the routing identity via
> a supplied attribute, are unaffected. A change of a filter that already
> sits at the wildcard handle is a metadata-only update and remains valid,
> so only a change that actually moves the handle is rejected.
> 
> This is a follow-up to commit 41e85e54e564 ("net/sched: cls_route: Fix
> in-place replace"); this patch closes the no-routing-attribute variant
> that the parent series did not address.
> 
> Conditions to recreate the bug:
>   tc qdisc add dev lo clsact
>   tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1
>   tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \
>       route classid 1:2
>   tc filter show dev lo ingress   # handle became 0xffff8000; iproute2's
>                                   # stored 0x10001 no longer addresses it
> 
> A change of a filter already at the wildcard handle, e.g. one created by
> "tc filter add dev lo ingress protocol ip pref 100 route classid 1:1"
> (iproute2 defaults the handle to 0xffff8000), stays a valid metadata-only
> update.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260907192133.2639067-1-victor@mojatatu.com
> Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Victor Nogueira <victor@mojatatu.com>

Reviewed-by: Simon Horman <horms@kernel.org>