tcf_mirred_get_fill_size budgets only TCA_MIRRED_PARMS, but tcf_mirred_dump also emits TCA_MIRRED_BLOCKID whenever the action was created with a block instead of a device, so the budget falls 8 bytes short of what the dump may produce for such actions. Account for TCA_MIRRED_BLOCKID unconditionally: reading tcfm_blockid to size it conditionally would race a concurrent replace, which can flip the action between device and block between sizing and dumping. Reported-by: Sashiko Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com Co-developed-by: Jamal Hadi Salim Signed-off-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira --- net/sched/act_mirred.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 553342c55cf7..1c98e4d81ebe 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -607,7 +607,8 @@ tcf_mirred_get_dev(const struct tc_action *a, static size_t tcf_mirred_get_fill_size(const struct tc_action *act) { - return nla_total_size(sizeof(struct tc_mirred)); + return nla_total_size(sizeof(struct tc_mirred)) /* TCA_MIRRED_PARMS */ + + nla_total_size(sizeof(u32)); /* TCA_MIRRED_BLOCKID */ } static void tcf_offload_mirred_get_dev(struct flow_action_entry *entry, -- 2.43.0