[PATCH net 2/4] net/sched: act_police: disallow 'goto chain' on fallback control action

[Davide Caratti]

in the following command:

 # tc action add action police rate <r> burst <b> conform-exceed <c1>/<c2>

'goto chain x' is allowed only for c1: setting it for c2 makes the kernel
crash with NULL pointer dereference, since TC core doesn't initialize the
chain handle.

Signed-off-by: Davide Caratti <dcara...@redhat.com>
---
 net/sched/act_police.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 5d8bfa878477..3b793393efd1 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -150,6 +150,16 @@ static int tcf_police_init(struct net *net, struct nlattr 
*nla,
                goto failure;
        }
 
+       if (tb[TCA_POLICE_RESULT]) {
+               police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
+               if (TC_ACT_EXT_CMP(police->tcfp_result, TC_ACT_GOTO_CHAIN)) {
+                       NL_SET_ERR_MSG(extack,
+                                      "goto chain not allowed on fallback");
+                       err = -EINVAL;
+                       goto failure;
+               }
+       }
+
        spin_lock_bh(&police->tcf_lock);
        /* No failure allowed after this point */
        police->tcfp_mtu = parm->mtu;
@@ -173,8 +183,6 @@ static int tcf_police_init(struct net *net, struct nlattr 
*nla,
                police->peak_present = false;
        }
 
-       if (tb[TCA_POLICE_RESULT])
-               police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
        police->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
        police->tcfp_toks = police->tcfp_burst;
        if (police->peak_present) {
-- 
2.17.1