fe384e2fa3
callers of tcf_gact_goto_chain_index() can potentially read an old value
of the chain index, or even dereference a NULL 'goto_chain' pointer,
because 'goto_chain' and 'tcfa_action' are read in the traffic path
without caring of concurrent write in the control path. The most recent
value of chain index can be read also from a->tcfa_action (it's encoded
there together with TC_ACT_GOTO_CHAIN bits), so we don't really need to
dereference 'goto_chain': just read the chain id from the control action.
Fixes:
|
||
|---|---|---|
| .. | ||
| tc_bpf.h | ||
| tc_connmark.h | ||
| tc_csum.h | ||
| tc_defact.h | ||
| tc_gact.h | ||
| tc_ife.h | ||
| tc_ipt.h | ||
| tc_mirred.h | ||
| tc_nat.h | ||
| tc_pedit.h | ||
| tc_sample.h | ||
| tc_skbedit.h | ||
| tc_skbmod.h | ||
| tc_tunnel_key.h | ||
| tc_vlan.h | ||