* [PATCH net 1/2] net/sched: act_api: inherit filter offload flags only on new actions
2026-10-21 19:32 [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions Alexandre Cassen
@ 2026-10-21 19:32 ` Alexandre Cassen
2026-10-26 16:53 ` Simon Horman
2026-10-21 19:32 ` [PATCH net 2/2] selftests: tc-testing: test offload flags of reused matchall actions Alexandre Cassen
2026-10-26 23:30 ` [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions patchwork-bot+netdevbpf
2 siblings, 1 reply; 6+ messages in thread
From: Alexandre Cassen @ 2026-10-21 19:32 UTC (permalink / raw)
To: Jamal Hadi Salim, Jiri Pirko
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Vladimir Oltean, Ido Schimmel, Shuah Khan, netdev,
linux-kselftest
tcf_action_init() gives the skip_sw and skip_hw flags of a filter to the
actions it binds. An action that another filter created gets them too,
they then apply to every filter that uses this action. When a
skip_sw filter reuses the action of a software filter, the software
filter silently stops running it. This happens even when the filter add
fails on a later action. A skip_hw filter likewise prevents a later
filter without flags from reusing the action.
Give the flags only to the actions that the filter creates. The mismatch
check still rejects a filter that reuses an action with a flag that the
filter does not have.
Discovered by manual code inspection after the Sashiko AI review [1] of
a tunnel_key patch questioned how actions get the filter flags.
Reproduced on netdevsim without kernel changes. The egress filter below
runs in software only, since netdevsim offloads only ingress filters.
Once the skip_sw filter reuses its drop action, the last command shows
skip_sw on this action and the egress filter stops dropping packets:
ethtool -K eth0 hw-tc-offload on
tc qdisc add dev eth0 clsact
tc filter add dev eth0 egress protocol ip flower dst_ip 192.0.2.1 \
action gact drop index 1
tc filter add dev eth0 ingress protocol ip flower skip_sw \
dst_ip 192.0.2.2 action gact drop index 1
tc actions get action gact index 1
Tested with the reproducer and the tc-testing action, matchall and
flower tests.
Fixes: 34d35b4edbbe ("net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009051930.3619697-1-acassen%40corp.free.fr [1]
Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
---
net/sched/act_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index d9d4f7097624..f238140d62ca 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -1551,6 +1551,9 @@ int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
err = -EINVAL;
goto err;
}
+ /* Other filters share an existing action */
+ if (init_res[i - 1] != ACT_P_CREATED)
+ continue;
if (skip_sw)
act->tcfa_flags |= TCA_ACT_FLAGS_SKIP_SW;
if (skip_hw)
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH net 2/2] selftests: tc-testing: test offload flags of reused matchall actions
2026-10-21 19:32 [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions Alexandre Cassen
2026-10-21 19:32 ` [PATCH net 1/2] net/sched: act_api: inherit filter offload flags only on new actions Alexandre Cassen
@ 2026-10-21 19:32 ` Alexandre Cassen
2026-10-26 16:53 ` Simon Horman
2026-10-26 23:30 ` [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions patchwork-bot+netdevbpf
2 siblings, 1 reply; 6+ messages in thread
From: Alexandre Cassen @ 2026-10-21 19:32 UTC (permalink / raw)
To: Jamal Hadi Salim, Jiri Pirko
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Vladimir Oltean, Ido Schimmel, Shuah Khan, netdev,
linux-kselftest
Check that a skip_hw filter leaves the flags of an action it reuses
unchanged, even when the filter add fails on a later action. Also check
that a filter without skip_hw still cannot reuse a skip_hw action. The
dummy device has no tc offload, so skip_hw stands in for skip_sw.
Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
---
.../tc-testing/tc-tests/filters/matchall.json | 71 +++++++++++++++++++
1 file changed, 71 insertions(+)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/matchall.json b/tools/testing/selftests/tc-testing/tc-tests/filters/matchall.json
index f8d28c415bc3..6b3eea401fc8 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/filters/matchall.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/matchall.json
@@ -481,6 +481,77 @@
"$TC actions del action police index 199"
]
},
+ {
+ "id": "230c",
+ "name": "Keep the flags of a gact action reused by a matchall filter with skip_hw",
+ "category": [
+ "filter",
+ "matchall"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "$TC qdisc add dev $DUMMY ingress",
+ "$TC filter add dev $DUMMY parent ffff: handle 0x1 prio 1 protocol ipv4 matchall action gact pass index 199"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DUMMY parent ffff: handle 0x2 prio 2 protocol ipv4 matchall skip_hw action gact pass index 199",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action gact index 199",
+ "matchPattern": "skip_hw",
+ "matchCount": "0",
+ "teardown": [
+ "$TC qdisc del dev $DUMMY ingress"
+ ]
+ },
+ {
+ "id": "1f7a",
+ "name": "Keep the flags of a gact action reused by a rejected matchall filter with skip_hw",
+ "category": [
+ "filter",
+ "matchall"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "$TC qdisc add dev $DUMMY ingress",
+ "$TC actions add action gact pass index 200",
+ "$TC filter add dev $DUMMY parent ffff: handle 0x1 prio 1 protocol ipv4 matchall action gact pass index 199"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DUMMY parent ffff: handle 0x2 prio 2 protocol ipv4 matchall skip_hw action gact pass index 199 action gact pass index 200",
+ "expExitCode": "2",
+ "verifyCmd": "$TC actions get action gact index 199",
+ "matchPattern": "skip_hw",
+ "matchCount": "0",
+ "teardown": [
+ "$TC qdisc del dev $DUMMY ingress",
+ "$TC actions del action gact index 200"
+ ]
+ },
+ {
+ "id": "9117",
+ "name": "Reject the reuse of a skip_hw gact action by a matchall filter without skip_hw",
+ "category": [
+ "filter",
+ "matchall"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ "$TC qdisc add dev $DUMMY ingress",
+ "$TC filter add dev $DUMMY parent ffff: handle 0x1 prio 1 protocol ipv4 matchall skip_hw action gact pass index 199"
+ ],
+ "cmdUnderTest": "$TC filter add dev $DUMMY parent ffff: handle 0x2 prio 2 protocol ipv4 matchall action gact pass index 199",
+ "expExitCode": "2",
+ "verifyCmd": "$TC filter get dev $DUMMY parent ffff: handle 2 prio 2 protocol ipv4 matchall",
+ "matchPattern": "^filter parent ffff: protocol ip pref 2 matchall.*handle 0x2.*",
+ "matchCount": "0",
+ "teardown": [
+ "$TC qdisc del dev $DUMMY ingress"
+ ]
+ },
{
"id": "2638",
"name": "Add matchall and try to get it",
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions
2026-10-21 19:32 [PATCH net 0/2] net/sched: act_api: keep the offload flags of shared actions Alexandre Cassen
2026-10-21 19:32 ` [PATCH net 1/2] net/sched: act_api: inherit filter offload flags only on new actions Alexandre Cassen
2026-10-21 19:32 ` [PATCH net 2/2] selftests: tc-testing: test offload flags of reused matchall actions Alexandre Cassen
@ 2026-10-26 23:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-10-26 23:30 UTC (permalink / raw)
To: Alexandre Cassen
Cc: jhs, jiri, davem, edumazet, kuba, pabeni, horms, vladimir.oltean,
idosch, shuah, netdev, linux-kselftest
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 21 Oct 2026 21:32:17 +0200 you wrote:
> When a filter reuses an action that another filter created, the action
> also gets the skip_sw and skip_hw flags of the new filter. These flags
> apply to every filter using the action. A software filter thus stops
> running its action once a skip_sw filter reuses it.
>
> Patch 1 lets only new actions inherit the flags of their filter. Patch 2
> adds tc-testing coverage on a dummy device.
>
> [...]
Here is the summary with links:
- [net,1/2] net/sched: act_api: inherit filter offload flags only on new actions
https://git.kernel.org/netdev/net/c/9463e8d8c692
- [net,2/2] selftests: tc-testing: test offload flags of reused matchall actions
https://git.kernel.org/netdev/net/c/4b3a32b56e5b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread