net: sched: don't use tc_action->order during action dump

Function tcf_action_dump() relies on tc_action->order field when starting
nested nla to send action data to userspace. This approach breaks in
several cases:

- When multiple filters point to same shared action, tc_action->order field
  is overwritten each time it is attached to filter. This causes filter
  dump to output action with incorrect attribute for all filters that have
  the action in different position (different order) from the last set
  tc_action->order value.

- When action data is displayed using tc action API (RTM_GETACTION), action
  order is overwritten by tca_action_gd() according to its position in
  resulting array of nl attributes, which will break filter dump for all
  filters attached to that shared action that expect it to have different
  order value.

Don't rely on tc_action->order when dumping actions. Set nla according to
action position in resulting array of actions instead.

Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 683fcc00da491e581ec5768e00269a494d3311a9..c42ecf4b3c100c777c6750f7f60049f30e04fc7f 100644 (file)
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -800,7 +800,7 @@ int tcf_action_dump(struct sk_buff *skb, struct tc_action *actions[],
 
        for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
                a = actions[i];
-               nest = nla_nest_start_noflag(skb, a->order);
+               nest = nla_nest_start_noflag(skb, i + 1);
                if (nest == NULL)
                        goto nla_put_failure;
                err = tcf_action_dump_1(skb, a, bind, ref);
@@ -1303,7 +1303,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                        ret = PTR_ERR(act);
                        goto err;
                }
-               act->order = i;
                attr_size += tcf_action_fill_size(act);
                actions[i - 1] = act;
        }