![]() callers of tcf_gact_goto_chain_index() can potentially read an old value
of the chain index, or even dereference a NULL 'goto_chain' pointer,
because 'goto_chain' and 'tcfa_action' are read in the traffic path
without caring of concurrent write in the control path. The most recent
value of chain index can be read also from a->tcfa_action (it's encoded
there together with TC_ACT_GOTO_CHAIN bits), so we don't really need to
dereference 'goto_chain': just read the chain id from the control action.
Fixes:
|
||
---|---|---|
.. | ||
tc_bpf.h | ||
tc_connmark.h | ||
tc_csum.h | ||
tc_defact.h | ||
tc_gact.h | ||
tc_ife.h | ||
tc_ipt.h | ||
tc_mirred.h | ||
tc_nat.h | ||
tc_pedit.h | ||
tc_sample.h | ||
tc_skbedit.h | ||
tc_skbmod.h | ||
tc_tunnel_key.h | ||
tc_vlan.h |