tca_action_gd() takes one reference per nested TCA_ACT_TAB entry while
tcf_action_delete() consumes two per slot, so three duplicate
TCA_ACT_INDEX entries in one RTM_DELACTION free the action mid-walk and
the next slot dereferences it. Assert a duplicate batch is rejected and
the action survives.
Conditions to recreate the bug:
tc actions add action pass index 1
tc actions delete action gact index 1 action gact index 1 \
action gact index 1
Testing:
Case 8135 fails on the unfixed kernel (tdc_8135_unfixed.log) and passes
with the fix, alongside the batch-delete family (tdc_8135_fixed.log).
Tested-by: hybris <[email protected]>
Signed-off-by: Jamal Hadi Salim <[email protected]>
---
.../tc-tests/actions/batch-delete.json | 33 +++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git
a/tools/testing/selftests/tc-testing/tc-tests/actions/batch-delete.json
b/tools/testing/selftests/tc-testing/tc-tests/actions/batch-delete.json
index ef7ca4a6775b..7620e927ae2c 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/batch-delete.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/batch-delete.json
@@ -111,5 +111,38 @@
255
]
]
+ },
+ {
+ "id": "8135",
+ "name": "Reject duplicate action in a delete batch",
+ "category": [
+ "actions",
+ "gact"
+ ],
+ "plugins": {
+ "requires": "nsPlugin"
+ },
+ "setup": [
+ [
+ "$TC actions flush action gact",
+ 0,
+ 1,
+ 255
+ ],
+ "$TC actions add action pass index 1"
+ ],
+ "cmdUnderTest": "$TC actions del action gact index 1 action gact index
1 action gact index 1",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions ls action gact",
+ "matchPattern": "total acts 1\\b.*index 1 ref 1 bind 0\\b",
+ "matchCount": "1",
+ "teardown": [
+ [
+ "$TC actions flush action gact",
+ 0,
+ 1,
+ 255
+ ]
+ ]
}
]
--
2.43.0
