net/sched: act_api: take tcfa_lock for hardware stats updates

Actions without per CPU stats update their counters under tcfa_lock in
the software path but tcf_action_update_stats() adds hardware stats to
the same counters without it. A dump of a filter without skip_hw does
this even when nothing is offloaded, so such an action loses counter
updates. On 32-bit, readers holding tcfa_lock can also observe torn
64-bit values.

Callers disable preemption around this update for the per CPU stats.
PREEMPT_RT forbids taking a spinlock_t with preemption disabled. Disable
BH in the per CPU path instead. On 32-bit, this also keeps a softirq on
the same CPU from updating or reading these counters in the middle of
the update.

Discovered by manual code inspection while letting more actions honor
TCA_ACT_FLAGS_NO_PERCPU_STATS. Reproduced in a VM without kernel
changes, where the second action counts fewer packets than the first:

  ip link add d0 type dummy && ip link set d0 up
  tc qdisc add dev d0 clsact
  tc filter add dev d0 ingress matchall \
     action gact pipe action gact pass no_percpu
  yes "filter show dev d0 ingress" | head -10000 > batch
  while :; do tc -s -b batch; done > /dev/null &
  samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh -i d0 -t 4
  tc -s filter show dev d0 ingress

The 32-bit issue in the per CPU path comes from the Sashiko AI review
of v1 [1] and was not reproduced.

Tested with the reproducer and the tc-testing action, matchall and
flower tests with lockdep enabled. Also tested for regressions on
ConnectX-7 with firmware 28.48.1000.

Cc: stable+noautosel@kernel.org # high regression risk, mixed-use actions are not commonly used in practice
Fixes: 5e174d5e73df ("net: sched: modify stats helper functions to support regular stats")
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261009051703.3615846-1-acassen%40corp.free.fr [1]
Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
Reviewed-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20261010152227.401987-1-acassen@corp.free.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions