linux-kernel - Re: [PATCH net 3/3] net: stmmac: check if interface is running before TC block setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250904185628.0de3c483@kernel.org>
Date: Thu, 4 Sep 2025 18:56:28 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Sebastian Basierski <sebastian.basierski@...el.com>
Cc: Konrad Leszczynski <konrad.leszczynski@...el.com>,
 <davem@...emloft.net>, <andrew+netdev@...n.ch>, <edumazet@...gle.com>,
 <pabeni@...hat.com>, <netdev@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <cezary.rojewski@...el.com>, Karol
 Jurczenia <karol.jurczenia@...el.com>
Subject: Re: [PATCH net 3/3] net: stmmac: check if interface is running
 before TC block setup

On Thu, 4 Sep 2025 21:01:49 +0200 Sebastian Basierski wrote:
> On 9/1/2025 10:03 PM, Jakub Kicinski wrote:
> > More context would be useful. What's the user-visible behavior before
> > and after? Can the device handle installing the filters while down?
> > Is it just an issue of us restarting the queues when we shouldn't?  
> 
> Before this patch driver couldn't be unloaded with tc filter applied.
> 
> Running those commands is enough to reproduce the issue:
>    tc qdisc add dev enp0s29f2 ingress
>    tc filter add dev enp0s29f2 ingress protocol all prio 1 u32
>    rmmod dwmac_intel
> 
> in effect module would not unload.

Makes sense. Could you also confirm that the offload doesn't in fact
work if set up when device is down? I think block setup is when qdisc
is installed?

ip link set dev $x down
tc qdisc add dev enp0s29f2 ingress
ip link set dev $x up
tc filter add dev enp0s29f2 ingress protocol all prio 1 u32 ...

If it doesn't work we can feel safe we're not breaking anyone's
scripts, however questionable.