[BUG] net/sched: duplicate RTM_DELACTION entries underflow action refcount

Hello,

Create one standalone gact action, then send one RTM_DELACTION request containing three entries with the same action kind and index. The duplicate references cause the delete path to drop the object’s reference more times than the batch owns.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/c37510312cb6cdfcc7a8dfa8567c0bfd/raw/b8fd79ae905833e51d6db058b2a6f715168b39cf/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/c37510312cb6cdfcc7a8dfa8567c0bfd/raw/1acf6d132666c0f60829ca94c0995f5c5f31f5ff/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/c37510312cb6cdfcc7a8dfa8567c0bfd/raw/a46ac914f3b3cd2abdf52898f90a993038d7f442/poc.c

Build the tested kernel with the attached configuration and run the static poc.c in a disposable guest with CAP_NET_ADMIN in the tested network namespace. The program creates the action and sends a duplicate-index RTM_DELACTION batch.

Impact and prerequisites:
The kernel reports a refcount underflow from __tcf_action_put() while processing a user-controlled rtnetlink request. panic_on_warn can turn the warning into a panic. The evidence does not establish controlled use-after-free, memory corruption or privilege escalation; CAP_NET_ADMIN in the initial user namespace is required; an ordinary user namespace does not pass this action API capability check.

Validation: Two fresh exact-revision boots reproduced the underflow warning; the two-duplicate close control returned without the warning.

Thanks,

shaos