linux-kernel - Re: [PATCH net 3/3] net: stmmac: check if interface is running before TC block setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250916162914.264a1ee6@kernel.org>
Date: Tue, 16 Sep 2025 16:29:14 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Sebastian Basierski <sebastian.basierski@...el.com>
Cc: Konrad Leszczynski <konrad.leszczynski@...el.com>,
 <davem@...emloft.net>, <andrew+netdev@...n.ch>, <edumazet@...gle.com>,
 <pabeni@...hat.com>, <netdev@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <cezary.rojewski@...el.com>, Karol
 Jurczenia <karol.jurczenia@...el.com>
Subject: Re: [PATCH net 3/3] net: stmmac: check if interface is running
 before TC block setup

On Tue, 9 Sep 2025 20:47:01 +0200 Sebastian Basierski wrote:
> >> Before this patch driver couldn't be unloaded with tc filter applied.
> >>
> >> Running those commands is enough to reproduce the issue:
> >>     tc qdisc add dev enp0s29f2 ingress
> >>     tc filter add dev enp0s29f2 ingress protocol all prio 1 u32
> >>     rmmod dwmac_intel
> >>
> >> in effect module would not unload.  
> > Makes sense. Could you also confirm that the offload doesn't in fact
> > work if set up when device is down? I think block setup is when qdisc
> > is installed?
> >
> > ip link set dev $x down
> > tc qdisc add dev enp0s29f2 ingress
> > ip link set dev $x up
> > tc filter add dev enp0s29f2 ingress protocol all prio 1 u32 ...
> >
> > If it doesn't work we can feel safe we're not breaking anyone's
> > scripts, however questionable.  
> Sorry for late response.
> I just checked what you asked for.
>    x="enp129s29f0"
>    ip link set dev $x down
>    tc qdisc add dev $x ingress
>    ip link set dev $x up
>    tc filter add dev $x ingress protocol ip flower ip_proto 1 action drop
> Looks like with and without patch ICMP packets are dropped.

Aren't you testing non-offloaded filter?
Test with skip_sw, if it works it means that some order of commands may
have indeed worked.