[IPV6]: Lost locking in fl6_sock_lookup
[safe/jmp/linux-2.6] / net / ipv6 / ip6_flowlabel.c
index b6c73da..f40a086 100644 (file)
@@ -9,7 +9,7 @@
  *     Authors:        Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  */
 
-#include <linux/config.h>
+#include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -21,6 +21,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
+#include <net/net_namespace.h>
 #include <net/sock.h>
 
 #include <net/ipv6.h>
@@ -50,7 +51,7 @@ static atomic_t fl_size = ATOMIC_INIT(0);
 static struct ip6_flowlabel *fl_ht[FL_HASH_MASK+1];
 
 static void ip6_fl_gc(unsigned long dummy);
-static struct timer_list ip6_fl_gc_timer = TIMER_INITIALIZER(ip6_fl_gc, 0, 0);
+static DEFINE_TIMER(ip6_fl_gc_timer, ip6_fl_gc, 0, 0);
 
 /* FL hash table lock: it protects only of GC */
 
@@ -61,7 +62,7 @@ static DEFINE_RWLOCK(ip6_fl_lock);
 static DEFINE_RWLOCK(ip6_sk_fl_lock);
 
 
-static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
+static __inline__ struct ip6_flowlabel * __fl_lookup(__be32 label)
 {
        struct ip6_flowlabel *fl;
 
@@ -72,7 +73,7 @@ static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
        return NULL;
 }
 
-static struct ip6_flowlabel * fl_lookup(u32 label)
+static struct ip6_flowlabel * fl_lookup(__be32 label)
 {
        struct ip6_flowlabel *fl;
 
@@ -153,7 +154,7 @@ static void ip6_fl_gc(unsigned long dummy)
        write_unlock(&ip6_fl_lock);
 }
 
-static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
+static int fl_intern(struct ip6_flowlabel *fl, __be32 label)
 {
        fl->label = label & IPV6_FLOWLABEL_MASK;
 
@@ -182,24 +183,29 @@ static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
 
 /* Socket flowlabel lists */
 
-struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, u32 label)
+struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, __be32 label)
 {
        struct ipv6_fl_socklist *sfl;
        struct ipv6_pinfo *np = inet6_sk(sk);
 
        label &= IPV6_FLOWLABEL_MASK;
 
+       read_lock_bh(&ip6_sk_fl_lock);
        for (sfl=np->ipv6_fl_list; sfl; sfl = sfl->next) {
                struct ip6_flowlabel *fl = sfl->fl;
                if (fl->label == label) {
+                       read_unlock_bh(&ip6_sk_fl_lock);
                        fl->lastuse = jiffies;
                        atomic_inc(&fl->users);
                        return fl;
                }
        }
+       read_unlock_bh(&ip6_sk_fl_lock);
        return NULL;
 }
 
+EXPORT_SYMBOL_GPL(fl6_sock_lookup);
+
 void fl6_free_socklist(struct sock *sk)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -284,10 +290,9 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
        int err;
 
        err = -ENOMEM;
-       fl = kmalloc(sizeof(*fl), GFP_KERNEL);
+       fl = kzalloc(sizeof(*fl), GFP_KERNEL);
        if (fl == NULL)
                goto done;
-       memset(fl, 0, sizeof(*fl));
 
        olen = optlen - CMSG_ALIGN(sizeof(*freq));
        if (olen > 0) {
@@ -310,7 +315,7 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
                msg.msg_control = (void*)(fl->opt+1);
                flowi.oif = 0;
 
-               err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk);
+               err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk, &junk);
                if (err)
                        goto done;
                err = -EINVAL;
@@ -329,8 +334,10 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
        fl->share = freq->flr_share;
        addr_type = ipv6_addr_type(&freq->flr_dst);
        if ((addr_type&IPV6_ADDR_MAPPED)
-           || addr_type == IPV6_ADDR_ANY)
+           || addr_type == IPV6_ADDR_ANY) {
+               err = -EINVAL;
                goto done;
+       }
        ipv6_addr_copy(&fl->dst, &freq->flr_dst);
        atomic_set(&fl->users, 1);
        switch (fl->share) {
@@ -405,6 +412,16 @@ static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
        return 0;
 }
 
+static inline void fl_link(struct ipv6_pinfo *np, struct ipv6_fl_socklist *sfl,
+               struct ip6_flowlabel *fl)
+{
+       write_lock_bh(&ip6_sk_fl_lock);
+       sfl->fl = fl;
+       sfl->next = np->ipv6_fl_list;
+       np->ipv6_fl_list = sfl;
+       write_unlock_bh(&ip6_sk_fl_lock);
+}
+
 int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 {
        int err;
@@ -479,7 +496,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                                                goto done;
                                        }
                                        fl1 = sfl->fl;
-                                       atomic_inc(&fl->users);
+                                       atomic_inc(&fl1->users);
                                        break;
                                }
                        }
@@ -509,11 +526,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                                        fl1->linger = fl->linger;
                                if ((long)(fl->expires - fl1->expires) > 0)
                                        fl1->expires = fl->expires;
-                               write_lock_bh(&ip6_sk_fl_lock);
-                               sfl1->fl = fl1;
-                               sfl1->next = np->ipv6_fl_list;
-                               np->ipv6_fl_list = sfl1;
-                               write_unlock_bh(&ip6_sk_fl_lock);
+                               fl_link(np, sfl1, fl1);
                                fl_free(fl);
                                return 0;
 
@@ -541,9 +554,7 @@ release:
                        }
                }
 
-               sfl1->fl = fl;
-               sfl1->next = np->ipv6_fl_list;
-               np->ipv6_fl_list = sfl1;
+               fl_link(np, sfl1, fl);
                return 0;
 
        default:
@@ -586,6 +597,8 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
        while (!fl) {
                if (++state->bucket <= FL_HASH_MASK)
                        fl = fl_ht[state->bucket];
+               else
+                       break;
        }
        return fl;
 }
@@ -622,13 +635,15 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
        read_unlock_bh(&ip6_fl_lock);
 }
 
-static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
+static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
-       while(fl) {
+       if (v == SEQ_START_TOKEN)
+               seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
+                          "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
+       else {
+               struct ip6_flowlabel *fl = v;
                seq_printf(seq,
-                          "%05X %-1d %-6d %-6d %-6ld %-8ld "
-                          "%02x%02x%02x%02x%02x%02x%02x%02x "
-                          "%-4d\n",
+                          "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
                           (unsigned)ntohl(fl->label),
                           fl->share,
                           (unsigned)fl->owner,
@@ -637,21 +652,11 @@ static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
                           (long)(fl->expires - jiffies)/HZ,
                           NIP6(fl->dst),
                           fl->opt ? fl->opt->opt_nflen : 0);
-               fl = fl->next;
        }
-}
-
-static int ip6fl_seq_show(struct seq_file *seq, void *v)
-{
-       if (v == SEQ_START_TOKEN)
-               seq_puts(seq, "Label S Owner  Users  Linger Expires  "
-                             "Dst                              Opt\n");
-       else
-               ip6fl_fl_seq_show(seq, v);
        return 0;
 }
 
-static struct seq_operations ip6fl_seq_ops = {
+static const struct seq_operations ip6fl_seq_ops = {
        .start  =       ip6fl_seq_start,
        .next   =       ip6fl_seq_next,
        .stop   =       ip6fl_seq_stop,
@@ -660,28 +665,11 @@ static struct seq_operations ip6fl_seq_ops = {
 
 static int ip6fl_seq_open(struct inode *inode, struct file *file)
 {
-       struct seq_file *seq;
-       int rc = -ENOMEM;
-       struct ip6fl_iter_state *s = kmalloc(sizeof(*s), GFP_KERNEL);
-
-       if (!s)
-               goto out;
-
-       rc = seq_open(file, &ip6fl_seq_ops);
-       if (rc)
-               goto out_kfree;
-
-       seq = file->private_data;
-       seq->private = s;
-       memset(s, 0, sizeof(*s));
-out:
-       return rc;
-out_kfree:
-       kfree(s);
-       goto out;
+       return seq_open_private(file, &ip6fl_seq_ops,
+                       sizeof(struct ip6fl_iter_state));
 }
 
-static struct file_operations ip6fl_seq_fops = {
+static const struct file_operations ip6fl_seq_fops = {
        .owner          =       THIS_MODULE,
        .open           =       ip6fl_seq_open,
        .read           =       seq_read,
@@ -694,7 +682,7 @@ static struct file_operations ip6fl_seq_fops = {
 void ip6_flowlabel_init(void)
 {
 #ifdef CONFIG_PROC_FS
-       proc_net_fops_create("ip6_flowlabel", S_IRUGO, &ip6fl_seq_fops);
+       proc_net_fops_create(&init_net, "ip6_flowlabel", S_IRUGO, &ip6fl_seq_fops);
 #endif
 }
 
@@ -702,6 +690,6 @@ void ip6_flowlabel_cleanup(void)
 {
        del_timer(&ip6_fl_gc_timer);
 #ifdef CONFIG_PROC_FS
-       proc_net_remove("ip6_flowlabel");
+       proc_net_remove(&init_net, "ip6_flowlabel");
 #endif
 }