[PATCH net v1 0/2] net/sched: fix action batch failure cleanup

[PATCH net v1 0/2] net/sched: fix action batch failure cleanup

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Failed batched RTM_NEWACTION requests can leak action references and
reserved IDR indices when cleanup encounters a filter-bound action.

Patch 1 fixes the failure cleanup.

Patch 2 adds tc-testing regression coverage.

Failure reproduction (key output excerpts):

  python3 tdc.py -f tc-tests/actions/gact-rollback.json

not ok 1 e3b1 - Failed action batch releases a bound action reference
	Could not match regex pattern. Verify command output:
[...]
	 index 1 ref 3 bind 1

not ok 2 e3b2 - Failed action batch releases entries after a bound action
	Command exited with 255, expected 0
RTNETLINK answers: Resource temporarily unavailable
We have an error talking to the kernel

not ok 3 e3b3 - Failed action batch releases repeated references to a bound action
	Could not match regex pattern. Verify command output:
[...]
	 index 1 ref 4 bind 1

Xuanqiang Luo (2):
  net/sched: act_api: release all action references on NEWACTION failure
  selftests: tc-testing: test action batch failure cleanup

 net/sched/act_api.c                           |  9 +--
 .../tc-tests/actions/gact-rollback.json       | 78 +++++++++++++++++++
 2 files changed, 80 insertions(+), 7 deletions(-)
 create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json


base-commit: a401a9d547c50ef34db1088cc1fb9a201a7af657
-- 
2.43.0

[PATCH net v1 1/2] net/sched: act_api: release all action references on NEWACTION failure

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

When a batched RTM_NEWACTION request replaces an existing action,
tcf_idr_check_alloc() takes a temporary reference on it. If a later
action fails to initialize, tcf_action_destroy() uses strict release
semantics to clean up the actions initialized so far. For an action
bound to a filter, the strict check returns -EPERM without dropping
the temporary reference.

This error also makes tcf_action_destroy() return before releasing
subsequent entries. Any new action initialized between the bound
action and the failing entry is leaked together with its reserved
IDR slot, preventing reuse of its index.

Use tcf_idr_release() to drop each reference held by the batch without
rejecting bound actions. This allows cleanup to continue through all
initialized entries and preserves the module reference release when
an action is destroyed. Explicit action deletion and flushing retain
their separate bind-count checks.

Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/sched/act_api.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 37eced84dfa5f..19501dc994641 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -1200,18 +1200,13 @@ EXPORT_SYMBOL(tcf_action_exec);
 
 int tcf_action_destroy(struct tc_action *actions[], int bind)
 {
-	const struct tc_action_ops *ops;
 	struct tc_action *a;
 	int ret = 0, i;
 
 	tcf_act_for_each_action(i, a, actions) {
 		actions[i] = NULL;
-		ops = a->ops;
-		ret = __tcf_idr_release(a, bind, true);
-		if (ret == ACT_P_DELETED)
-			module_put(ops->owner);
-		else if (ret < 0)
-			return ret;
+		/* Drop our reference even if the action is still bound to a filter. */
+		ret = tcf_idr_release(a, bind);
 	}
 	return ret;
 }
-- 
2.43.0

[PATCH net v1 2/2] selftests: tc-testing: test action batch failure cleanup

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Add tests for cleanup after a batched RTM_NEWACTION request fails.
Replace an existing gact action bound to a filter, then fail a later
entry by requesting goto chain without a classifier context.

Check that the bound action's reference count returns to its original
value. Also cover a successfully initialized new action between the
bound action and the failing entry, verifying that its reserved index
can be reused. Repeat the bound action in another batch to check that
each temporary reference to the same action is released.

Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 .../tc-tests/actions/gact-rollback.json       | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json

diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json b/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json
new file mode 100644
index 0000000000000..e92a4180db689
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json
@@ -0,0 +1,78 @@
+[
+    {
+        "id": "e3b1",
+        "name": "Failed action batch releases a bound action reference",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "plugins": {
+           "requires": "nsPlugin"
+        },
+        "setup": [
+            "$TC qdisc add dev $DEV1 ingress",
+            "$TC actions add action pass index 1",
+            "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall action gact index 1"
+        ],
+        "cmdUnderTest": "$TC actions replace action pass index 1 action goto chain 42 index 3",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action gact",
+        "matchPattern": "total acts 1.*index 1 ref 2 bind 1",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 ingress"
+        ]
+    },
+    {
+        "id": "e3b2",
+        "name": "Failed action batch releases entries after a bound action",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "plugins": {
+           "requires": "nsPlugin"
+        },
+        "setup": [
+            "$TC qdisc add dev $DEV1 ingress",
+            "$TC actions add action pass index 1",
+            "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall action gact index 1",
+            [
+                "$TC actions replace action pass index 1 action pass index 2 action goto chain 42 index 3",
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action pass index 2",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions ls action gact",
+        "matchPattern": "total acts 2.*index 1 ref 2 bind 1.*index 2 ref 1 bind 0",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 ingress"
+        ]
+    },
+    {
+        "id": "e3b3",
+        "name": "Failed action batch releases repeated references to a bound action",
+        "category": [
+            "actions",
+            "gact"
+        ],
+        "plugins": {
+           "requires": "nsPlugin"
+        },
+        "setup": [
+            "$TC qdisc add dev $DEV1 ingress",
+            "$TC actions add action pass index 1",
+            "$TC filter add dev $DEV1 protocol all ingress prio 1 matchall action gact index 1"
+        ],
+        "cmdUnderTest": "$TC actions replace action pass index 1 action pass index 1 action goto chain 42 index 3",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action gact",
+        "matchPattern": "total acts 1.*index 1 ref 2 bind 1",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV1 ingress"
+        ]
+    }
+]
-- 
2.43.0

Re: [PATCH net v1 0/2] net/sched: fix action batch failure cleanup

[Jamal Hadi Salim]

On Wed, Sep 9, 2026 at 3:04 AM Xuanqiang Luo <xuanqiang.luo@linux.dev> wrote:
>
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> Failed batched RTM_NEWACTION requests can leak action references and
> reserved IDR indices when cleanup encounters a filter-bound action.
>
> Patch 1 fixes the failure cleanup.
>
> Patch 2 adds tc-testing regression coverage.
>
> Failure reproduction (key output excerpts):
>
>   python3 tdc.py -f tc-tests/actions/gact-rollback.json
>
> not ok 1 e3b1 - Failed action batch releases a bound action reference
>         Could not match regex pattern. Verify command output:
> [...]
>          index 1 ref 3 bind 1
>
> not ok 2 e3b2 - Failed action batch releases entries after a bound action
>         Command exited with 255, expected 0
> RTNETLINK answers: Resource temporarily unavailable
> We have an error talking to the kernel
>
> not ok 3 e3b3 - Failed action batch releases repeated references to a bound action
>         Could not match regex pattern. Verify command output:
> [...]
>          index 1 ref 4 bind 1
>

Thank you for providing a reproducer.
For the series:
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>

cheers,
jamal
> Xuanqiang Luo (2):
>   net/sched: act_api: release all action references on NEWACTION failure
>   selftests: tc-testing: test action batch failure cleanup
>
>  net/sched/act_api.c                           |  9 +--
>  .../tc-tests/actions/gact-rollback.json       | 78 +++++++++++++++++++
>  2 files changed, 80 insertions(+), 7 deletions(-)
>  create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/gact-rollback.json
>
>
> base-commit: a401a9d547c50ef34db1088cc1fb9a201a7af657
> --
> 2.43.0
>

Re: [PATCH net v1 0/2] net/sched: fix action batch failure cleanup

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  9 Sep 2026 15:03:34 +0800 you wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> Failed batched RTM_NEWACTION requests can leak action references and
> reserved IDR indices when cleanup encounters a filter-bound action.
> 
> Patch 1 fixes the failure cleanup.
> 
> [...]

Here is the summary with links:
  - [net,v1,1/2] net/sched: act_api: release all action references on NEWACTION failure
    https://git.kernel.org/netdev/net/c/478eb5abb519
  - [net,v1,2/2] selftests: tc-testing: test action batch failure cleanup
    https://git.kernel.org/netdev/net/c/2a86bbed9f60

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html