Re: [PATCH net] net/sched: add get_fill_size callbacks for actions missing them

On Wed, 12 Aug 2026 14:53:15 -0300 Victor Nogueira wrote:
> > On Mon, 10 Aug 2026 13:43:57 -0300 Victor Nogueira wrote:  
> > > When an RTM_NEWACTION request with NLM_F_ECHO (or an RTNLGRP_TC
> > > listener) creates several actions, tcf_add_notify_msg() allocates the
> > > echo skb from this underestimated size. act_bpf is the clearest case:
> > > TCA_ACT_BPF_OPS alone reaches 32KB per action (BPF_MAXINSNS), so two
> > > actions are enough to overrun the allocation. act_pedit overruns with
> > > 32 actions of four munge keys each,  
> >
> > "overruns" makes it sounds like we overflow a buffer.  
> 
> Fair enough, it doesn't actually overflow a buffer.
> I can change that.
> 
> > AFAICT we'd at worse hit a WARN somewhere due to EMSGSIZE?  
> 
> The issue is more subtle.
> The kernel might create the actions, but fail to notify userspace
> because the notification message is too large for the allocated skb.
> So it's not a crash or a WARN, but rather a correctness issue.
> 
> > > act_police with 32 policers once the
> > > optional rate/peakrate/result/avrate attributes are present, and
> > > act_tunnel_key with a single action carrying a maximum-sized geneve
> > > option blob, whose 63 class/type/data attribute triplets expand to about
> > > 1.2KB. tca_get_fill() then fails and the request returns -EINVAL, but
> > > tcf_action_init() has already committed the actions via
> > > tcf_idr_insert_many(), so they stay installed even though userspace is
> > > told the request failed.  
> >
> > Please TAL at Clashiko review.  
> 
> Yes, I belive it's correct - the code should acquire the lock in act_bpf.
> Also yes, the GET path suffers from the same issue, I can send a fix
> for it as a follow up.

to be clear - im expecting a respin with a much better commit msg