[IPV6]: Lost locking in fl6_sock_lookup

[safe/jmp/linux-2.6] / net / ipv6 / ip6_flowlabel.c

diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 062e526..f40a086 100644 (file)
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -21,6 +21,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
+#include <net/net_namespace.h>
 #include <net/sock.h>
 
 #include <net/ipv6.h>
@@ -61,7 +62,7 @@ static DEFINE_RWLOCK(ip6_fl_lock);
 static DEFINE_RWLOCK(ip6_sk_fl_lock);
 
 
-static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
+static __inline__ struct ip6_flowlabel * __fl_lookup(__be32 label)
 {
        struct ip6_flowlabel *fl;
 
@@ -72,7 +73,7 @@ static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
        return NULL;
 }
 
-static struct ip6_flowlabel * fl_lookup(u32 label)
+static struct ip6_flowlabel * fl_lookup(__be32 label)
 {
        struct ip6_flowlabel *fl;
 
@@ -153,7 +154,7 @@ static void ip6_fl_gc(unsigned long dummy)
        write_unlock(&ip6_fl_lock);
 }
 
-static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
+static int fl_intern(struct ip6_flowlabel *fl, __be32 label)
 {
        fl->label = label & IPV6_FLOWLABEL_MASK;
 
@@ -182,21 +183,24 @@ static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
 
 /* Socket flowlabel lists */
 
-struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, u32 label)
+struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, __be32 label)
 {
        struct ipv6_fl_socklist *sfl;
        struct ipv6_pinfo *np = inet6_sk(sk);
 
        label &= IPV6_FLOWLABEL_MASK;
 
+       read_lock_bh(&ip6_sk_fl_lock);
        for (sfl=np->ipv6_fl_list; sfl; sfl = sfl->next) {
                struct ip6_flowlabel *fl = sfl->fl;
                if (fl->label == label) {
+                       read_unlock_bh(&ip6_sk_fl_lock);
                        fl->lastuse = jiffies;
                        atomic_inc(&fl->users);
                        return fl;
                }
        }
+       read_unlock_bh(&ip6_sk_fl_lock);
        return NULL;
 }
 
@@ -228,10 +232,10 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                                         struct ipv6_txoptions * fopt)
 {
        struct ipv6_txoptions * fl_opt = fl->opt;
-       
+
        if (fopt == NULL || fopt->opt_flen == 0)
                return fl_opt;
-       
+
        if (fl_opt != NULL) {
                opt_space->hopopt = fl_opt->hopopt;
                opt_space->dst0opt = fl_opt->dst0opt;
@@ -330,8 +334,10 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
        fl->share = freq->flr_share;
        addr_type = ipv6_addr_type(&freq->flr_dst);
        if ((addr_type&IPV6_ADDR_MAPPED)
-           || addr_type == IPV6_ADDR_ANY)
+           || addr_type == IPV6_ADDR_ANY) {
+               err = -EINVAL;
                goto done;
+       }
        ipv6_addr_copy(&fl->dst, &freq->flr_dst);
        atomic_set(&fl->users, 1);
        switch (fl->share) {
@@ -406,6 +412,16 @@ static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
        return 0;
 }
 
+static inline void fl_link(struct ipv6_pinfo *np, struct ipv6_fl_socklist *sfl,
+               struct ip6_flowlabel *fl)
+{
+       write_lock_bh(&ip6_sk_fl_lock);
+       sfl->fl = fl;
+       sfl->next = np->ipv6_fl_list;
+       np->ipv6_fl_list = sfl;
+       write_unlock_bh(&ip6_sk_fl_lock);
+}
+
 int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 {
        int err;
@@ -510,11 +526,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                                        fl1->linger = fl->linger;
                                if ((long)(fl->expires - fl1->expires) > 0)
                                        fl1->expires = fl->expires;
-                               write_lock_bh(&ip6_sk_fl_lock);
-                               sfl1->fl = fl1;
-                               sfl1->next = np->ipv6_fl_list;
-                               np->ipv6_fl_list = sfl1;
-                               write_unlock_bh(&ip6_sk_fl_lock);
+                               fl_link(np, sfl1, fl1);
                                fl_free(fl);
                                return 0;
 
@@ -542,9 +554,7 @@ release:
                        }
                }
 
-               sfl1->fl = fl;
-               sfl1->next = np->ipv6_fl_list;
-               np->ipv6_fl_list = sfl1;
+               fl_link(np, sfl1, fl);
                return 0;
 
        default:
@@ -625,9 +635,13 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
        read_unlock_bh(&ip6_fl_lock);
 }
 
-static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
+static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
-       while(fl) {
+       if (v == SEQ_START_TOKEN)
+               seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
+                          "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
+       else {
+               struct ip6_flowlabel *fl = v;
                seq_printf(seq,
                           "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
                           (unsigned)ntohl(fl->label),
@@ -638,21 +652,11 @@ static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
                           (long)(fl->expires - jiffies)/HZ,
                           NIP6(fl->dst),
                           fl->opt ? fl->opt->opt_nflen : 0);
-               fl = fl->next;
        }
-}
-
-static int ip6fl_seq_show(struct seq_file *seq, void *v)
-{
-       if (v == SEQ_START_TOKEN)
-               seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
-                          "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
-       else
-               ip6fl_fl_seq_show(seq, v);
        return 0;
 }
 
-static struct seq_operations ip6fl_seq_ops = {
+static const struct seq_operations ip6fl_seq_ops = {
        .start  =       ip6fl_seq_start,
        .next   =       ip6fl_seq_next,
        .stop   =       ip6fl_seq_stop,
@@ -661,27 +665,11 @@ static struct seq_operations ip6fl_seq_ops = {
 
 static int ip6fl_seq_open(struct inode *inode, struct file *file)
 {
-       struct seq_file *seq;
-       int rc = -ENOMEM;
-       struct ip6fl_iter_state *s = kzalloc(sizeof(*s), GFP_KERNEL);
-
-       if (!s)
-               goto out;
-
-       rc = seq_open(file, &ip6fl_seq_ops);
-       if (rc)
-               goto out_kfree;
-
-       seq = file->private_data;
-       seq->private = s;
-out:
-       return rc;
-out_kfree:
-       kfree(s);
-       goto out;
+       return seq_open_private(file, &ip6fl_seq_ops,
+                       sizeof(struct ip6fl_iter_state));
 }
 
-static struct file_operations ip6fl_seq_fops = {
+static const struct file_operations ip6fl_seq_fops = {
        .owner          =       THIS_MODULE,
        .open           =       ip6fl_seq_open,
        .read           =       seq_read,
@@ -694,7 +682,7 @@ static struct file_operations ip6fl_seq_fops = {
 void ip6_flowlabel_init(void)
 {
 #ifdef CONFIG_PROC_FS
-       proc_net_fops_create("ip6_flowlabel", S_IRUGO, &ip6fl_seq_fops);
+       proc_net_fops_create(&init_net, "ip6_flowlabel", S_IRUGO, &ip6fl_seq_fops);
 #endif
 }
 
@@ -702,6 +690,6 @@ void ip6_flowlabel_cleanup(void)
 {
        del_timer(&ip6_fl_gc_timer);
 #ifdef CONFIG_PROC_FS
-       proc_net_remove("ip6_flowlabel");
+       proc_net_remove(&init_net, "ip6_flowlabel");
 #endif
 }