[PATCH net-next 0/3] net/sched: get_fill_size() budget fixes for act_gact and act_vlan

[Linkui Xiao]

The get_fill_size() cleanup began with commit 8e2efb3f45a5
("net/sched: add get_fill_size callbacks for actions missing them")
[1], which fixed the actions the bug was reproduced with, pointed at
act_gact/act_skbedit/act_vlan as the pattern to follow, and left the
other pre-existing issues to upcoming patches.  It continued with
commit 4ba61bfd4998 ("net/sched: add get_fill_size() to the five
actions that lack one"), which spelled out the rule the callbacks have
to obey: size every optional attribute unconditionally, because reading
the current flags to size it conditionally races a concurrent replace
that can flip the attributes between sizing and dumping.

Auditing the remaining callbacks against their dumps turned up two gaps
in the very pattern 8e2efb3f45a5 held up:

  - act_gact reads tcfg_ptype with neither tcfg_lock nor READ_ONCE() and
    budgets TCA_GACT_PROB only when that read happens to be non-zero
    (patch 1);

  - act_vlan never budgets the two PUSH_ETH addresses its dump emits,
    and only escapes overflowing because the three PUSH_VLAN_*
    attributes that a PUSH_ETH instance does not emit happen to add up
    to exactly the same 24 bytes (patch 2).

Neither can overflow today.  All four consumers of the value --
tcf_get_notify(), tcf_del_notify_msg(), tcf_add_notify_msg() and
tcf_reoffload_del_notify_msg() -- allocate at least
max(attr_size, NLMSG_GOODSIZE), and NLMSG_GOODSIZE is
SKB_WITH_OVERHEAD(PAGE_SIZE), so a batch has to carry enough actions
for attr_size to grow past roughly 3.7 KiB before a 12- or 24-byte
shortfall matters.  A replace cannot interleave between sizing and
dumping either: RTM_NEWACTION, RTM_DELACTION and RTM_GETACTION all take
rtnl, and the classifier path, which can run without rtnl, computes
attr_size in tcf_exts_validate_ex() and discards it.  Both patches are
therefore accounting-correctness fixes against the rule above; each
carries a Fixes: tag for whoever wants it in stable.

For completeness, act_ct, act_tunnel_key and act_pedit also size some
attributes conditionally.  They do it from a single rcu_dereference() of
a params pointer that replace swaps rather than mutates, so the budget
stays consistent with the snapshot it was computed from.  act_gact
instead reads tcfg_ptype, a field mutated in place on the action itself,
with no lock and no READ_ONCE() -- that is what patch 1 fixes.  act_bpf
sizes conditionally too, but takes tcf_lock to do it; patch 1 removes
the read instead, which needs no lock.

Patch 3 adds TDC coverage for the previously untested gact dump and
get paths.

Tested by building net/sched with CONFIG_GACT_PROB=y and W=1, which
produced no new warnings, and by running the tdc gact and vlan suites
(38 and 36 cases, including the three added by patch 3) against a
CONFIG_GACT_PROB=y kernel with this series applied; all passed.

[1] https://patch.msgid.link/20260816201327.2435335-1-victor@xxxxxxxxxxxx