wl1251: fix a memory leak in probe

[safe/jmp/linux-2.6] / net / sched / cls_api.c

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 1086df7..5fd0c28 100644 (file)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -24,6 +24,7 @@
 #include <linux/kmod.h>
 #include <linux/netlink.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/netlink.h>
@@ -98,8 +99,9 @@ out:
 }
 EXPORT_SYMBOL(unregister_tcf_proto_ops);
 
-static int tfilter_notify(struct sk_buff *oskb, struct nlmsghdr *n,
-                         struct tcf_proto *tp, unsigned long fh, int event);
+static int tfilter_notify(struct net *net, struct sk_buff *oskb,
+                         struct nlmsghdr *n, struct tcf_proto *tp,
+                         unsigned long fh, int event);
 
 
 /* Select new prio value from the range, managed by kernel. */
@@ -120,6 +122,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
 {
        struct net *net = sock_net(skb->sk);
        struct nlattr *tca[TCA_MAX + 1];
+       spinlock_t *root_lock;
        struct tcmsg *t;
        u32 protocol;
        u32 prio;
@@ -134,9 +137,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
        unsigned long cl;
        unsigned long fh;
        int err;
-
-       if (net != &init_net)
-               return -EINVAL;
+       int tp_created = 0;
 
 replay:
        t = NLMSG_DATA(n);
@@ -156,7 +157,7 @@ replay:
        /* Find head of filter chain. */
 
        /* Find link */
-       dev = __dev_get_by_index(&init_net, t->tcm_ifindex);
+       dev = __dev_get_by_index(net, t->tcm_ifindex);
        if (dev == NULL)
                return -ENODEV;
 
@@ -166,7 +167,7 @@ replay:
 
        /* Find qdisc */
        if (!parent) {
-               q = dev->qdisc_sleeping;
+               q = dev->qdisc;
                parent = q->handle;
        } else {
                q = qdisc_lookup(dev, TC_H_MAJ(t->tcm_parent));
@@ -178,6 +179,9 @@ replay:
        if ((cops = q->ops->cl_ops) == NULL)
                return -EINVAL;
 
+       if (cops->tcf_chain == NULL)
+               return -EOPNOTSUPP;
+
        /* Do we search for filter, attached to class? */
        if (TC_H_MIN(parent)) {
                cl = cops->get(q, parent);
@@ -203,6 +207,8 @@ replay:
                }
        }
 
+       root_lock = qdisc_root_sleeping_lock(q);
+
        if (tp == NULL) {
                /* Proto-tcf does not exist, create new one */
 
@@ -220,10 +226,10 @@ replay:
                tp = kzalloc(sizeof(*tp), GFP_KERNEL);
                if (tp == NULL)
                        goto errout;
-               err = -EINVAL;
+               err = -ENOENT;
                tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
                if (tp_ops == NULL) {
-#ifdef CONFIG_KMOD
+#ifdef CONFIG_MODULES
                        struct nlattr *kind = tca[TCA_KIND];
                        char name[IFNAMSIZ];
 
@@ -250,7 +256,7 @@ replay:
                }
                tp->ops = tp_ops;
                tp->protocol = protocol;
-               tp->prio = nprio ? : tcf_auto_prio(*back);
+               tp->prio = nprio ? : TC_H_MAJ(tcf_auto_prio(*back));
                tp->q = q;
                tp->classify = tp_ops->classify;
                tp->classid = parent;
@@ -262,10 +268,7 @@ replay:
                        goto errout;
                }
 
-               qdisc_lock_tree(dev);
-               tp->next = *back;
-               *back = tp;
-               qdisc_unlock_tree(dev);
+               tp_created = 1;
 
        } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
                goto errout;
@@ -274,11 +277,11 @@ replay:
 
        if (fh == 0) {
                if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
-                       qdisc_lock_tree(dev);
+                       spin_lock_bh(root_lock);
                        *back = tp->next;
-                       qdisc_unlock_tree(dev);
+                       spin_unlock_bh(root_lock);
 
-                       tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
+                       tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
                        tcf_destroy(tp);
                        err = 0;
                        goto errout;
@@ -292,16 +295,19 @@ replay:
                switch (n->nlmsg_type) {
                case RTM_NEWTFILTER:
                        err = -EEXIST;
-                       if (n->nlmsg_flags & NLM_F_EXCL)
+                       if (n->nlmsg_flags & NLM_F_EXCL) {
+                               if (tp_created)
+                                       tcf_destroy(tp);
                                goto errout;
+                       }
                        break;
                case RTM_DELTFILTER:
                        err = tp->ops->delete(tp, fh);
                        if (err == 0)
-                               tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
+                               tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
                        goto errout;
                case RTM_GETTFILTER:
-                       err = tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+                       err = tfilter_notify(net, skb, n, tp, fh, RTM_NEWTFILTER);
                        goto errout;
                default:
                        err = -EINVAL;
@@ -310,8 +316,18 @@ replay:
        }
 
        err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-       if (err == 0)
-               tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+       if (err == 0) {
+               if (tp_created) {
+                       spin_lock_bh(root_lock);
+                       tp->next = *back;
+                       *back = tp;
+                       spin_unlock_bh(root_lock);
+               }
+               tfilter_notify(net, skb, n, tp, fh, RTM_NEWTFILTER);
+       } else {
+               if (tp_created)
+                       tcf_destroy(tp);
+       }
 
 errout:
        if (cl)
@@ -333,8 +349,8 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
        tcm = NLMSG_DATA(nlh);
        tcm->tcm_family = AF_UNSPEC;
        tcm->tcm__pad1 = 0;
-       tcm->tcm__pad1 = 0;
-       tcm->tcm_ifindex = tp->q->dev->ifindex;
+       tcm->tcm__pad2 = 0;
+       tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
        tcm->tcm_parent = tp->classid;
        tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
        NLA_PUT_STRING(skb, TCA_KIND, tp->ops->kind);
@@ -353,8 +369,9 @@ nla_put_failure:
        return -1;
 }
 
-static int tfilter_notify(struct sk_buff *oskb, struct nlmsghdr *n,
-                         struct tcf_proto *tp, unsigned long fh, int event)
+static int tfilter_notify(struct net *net, struct sk_buff *oskb,
+                         struct nlmsghdr *n, struct tcf_proto *tp,
+                         unsigned long fh, int event)
 {
        struct sk_buff *skb;
        u32 pid = oskb ? NETLINK_CB(oskb).pid : 0;
@@ -368,7 +385,7 @@ static int tfilter_notify(struct sk_buff *oskb, struct nlmsghdr *n,
                return -EINVAL;
        }
 
-       return rtnetlink_send(skb, &init_net, pid, RTNLGRP_TC,
+       return rtnetlink_send(skb, net, pid, RTNLGRP_TC,
                              n->nlmsg_flags & NLM_F_ECHO);
 }
 
@@ -387,6 +404,7 @@ static int tcf_node_dump(struct tcf_proto *tp, unsigned long n,
                             a->cb->nlh->nlmsg_seq, NLM_F_MULTI, RTM_NEWTFILTER);
 }
 
+/* called with RTNL */
 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
 {
        struct net *net = sock_net(skb->sk);
@@ -400,22 +418,21 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
        const struct Qdisc_class_ops *cops;
        struct tcf_dump_args arg;
 
-       if (net != &init_net)
-               return 0;
-
        if (cb->nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*tcm)))
                return skb->len;
-       if ((dev = dev_get_by_index(&init_net, tcm->tcm_ifindex)) == NULL)
+       if ((dev = __dev_get_by_index(net, tcm->tcm_ifindex)) == NULL)
                return skb->len;
 
        if (!tcm->tcm_parent)
-               q = dev->qdisc_sleeping;
+               q = dev->qdisc;
        else
                q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
        if (!q)
                goto out;
        if ((cops = q->ops->cl_ops) == NULL)
                goto errout;
+       if (cops->tcf_chain == NULL)
+               goto errout;
        if (TC_H_MIN(tcm->tcm_parent)) {
                cl = cops->get(q, tcm->tcm_parent);
                if (cl == 0)
@@ -465,7 +482,6 @@ errout:
        if (cl)
                cops->put(q, cl);
 out:
-       dev_put(dev);
        return skb->len;
 }
 
@@ -525,7 +541,8 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
        if (src->action) {
                struct tc_action *act;
                tcf_tree_lock(tp);
-               act = xchg(&dst->action, src->action);
+               act = dst->action;
+               dst->action = src->action;
                tcf_tree_unlock(tp);
                if (act)
                        tcf_action_destroy(act, TCA_ACT_UNBIND);