Re: [PATCH net] net/sched: add get_fill_size callbacks for actions missing them

On Tue, Aug 11, 2026 at 10:20 PM Jakub Kicinski <[email protected]> wrote:
>
> On Mon, 10 Aug 2026 13:43:57 -0300 Victor Nogueira wrote:
> > When an RTM_NEWACTION request with NLM_F_ECHO (or an RTNLGRP_TC
> > listener) creates several actions, tcf_add_notify_msg() allocates the
> > echo skb from this underestimated size. act_bpf is the clearest case:
> > TCA_ACT_BPF_OPS alone reaches 32KB per action (BPF_MAXINSNS), so two
> > actions are enough to overrun the allocation. act_pedit overruns with
> > 32 actions of four munge keys each,
>
> "overruns" makes it sounds like we overflow a buffer.

Fair enough, it doesn't actually overflow a buffer.
I can change that.

> AFAICT we'd at worse hit a WARN somewhere due to EMSGSIZE?

The issue is more subtle.
The kernel might create the actions, but fail to notify userspace
because the notification message is too large for the allocated skb.
So it's not a crash or a WARN, but rather a correctness issue.

> > act_police with 32 policers once the
> > optional rate/peakrate/result/avrate attributes are present, and
> > act_tunnel_key with a single action carrying a maximum-sized geneve
> > option blob, whose 63 class/type/data attribute triplets expand to about
> > 1.2KB. tca_get_fill() then fails and the request returns -EINVAL, but
> > tcf_action_init() has already committed the actions via
> > tcf_idr_insert_many(), so they stay installed even though userspace is
> > told the request failed.
>
> Please TAL at Clashiko review.

Yes, I belive it's correct - the code should acquire the lock in act_bpf.
Also yes, the GET path suffers from the same issue, I can send a fix
for it as a follow up.

cheers,
Victor