From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jamal Hadi Salim Subject: Re: [PATCH net 0/4] net/sched: forbid 'goto_chain' on fallback actions Date: Mon, 22 Oct 2018 14:39:15 -0400 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit To: Davide Caratti , Jiri Pirko , Cong Wang , "David S. Miller" , netdev@vger.kernel.org Return-path: Received: from mail-qt1-f195.google.com ([209.85.160.195]:37138 "EHLO mail-qt1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728308AbeJWC7G (ORCPT ); Mon, 22 Oct 2018 22:59:06 -0400 Received: by mail-qt1-f195.google.com with SMTP id d14-v6so47545376qto.4 for ; Mon, 22 Oct 2018 11:39:26 -0700 (PDT) In-Reply-To: Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 2018-10-20 5:33 p.m., Davide Caratti wrote: > the following command: > > # tc actions add action police rate 1mbit burst 1k conform-exceed \ > > pass / goto chain 42 > > generates a NULL pointer dereference when packets exceed the configured > rate. Similarly, the following command: > > # tc actions add action pass random determ goto chain 42 2 > > makes the kernel crash with NULL dereference when the first packet does > not match the 'pass' action. > > gact and police allow users to specify a fallback control action, that is > stored in the action private data. 'goto chain x' never worked for these > cases, since a->goto_chain handle was never initialized. There is only one > goto_chain handle per TC action, and it is designed to be non-NULL only if > tcf_action contains a 'goto chain' command. So, let's forbid 'goto chain' > on fallback actions. > > Patch 1/4 and 2/4 change the .init() functions of police and gact, to let > them return an error when users try to set 'goto chain x' in the fallback > action. Patch 3/4 and 4/4 add TDC selftest coverage to this new behavior. > For the series, Acked-by: Jamal Hadi Salim cheers, jamal