pktgen: Dont leak kernel memory
[safe/jmp/linux-2.6] / net / sched / cls_api.c
index 87be2b2..7cf6c0f 100644 (file)
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/netlink.h>
+#include <linux/err.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/netlink.h>
@@ -117,8 +118,9 @@ static inline u32 tcf_auto_prio(struct tcf_proto *tp)
 
 static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
 {
-       struct net *net = skb->sk->sk_net;
+       struct net *net = sock_net(skb->sk);
        struct nlattr *tca[TCA_MAX + 1];
+       spinlock_t *root_lock;
        struct tcmsg *t;
        u32 protocol;
        u32 prio;
@@ -133,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
        unsigned long cl;
        unsigned long fh;
        int err;
+       int tp_created = 0;
 
        if (net != &init_net)
                return -EINVAL;
@@ -165,7 +168,7 @@ replay:
 
        /* Find qdisc */
        if (!parent) {
-               q = dev->qdisc_sleeping;
+               q = dev->qdisc;
                parent = q->handle;
        } else {
                q = qdisc_lookup(dev, TC_H_MAJ(t->tcm_parent));
@@ -177,6 +180,9 @@ replay:
        if ((cops = q->ops->cl_ops) == NULL)
                return -EINVAL;
 
+       if (cops->tcf_chain == NULL)
+               return -EOPNOTSUPP;
+
        /* Do we search for filter, attached to class? */
        if (TC_H_MIN(parent)) {
                cl = cops->get(q, parent);
@@ -202,6 +208,8 @@ replay:
                }
        }
 
+       root_lock = qdisc_root_sleeping_lock(q);
+
        if (tp == NULL) {
                /* Proto-tcf does not exist, create new one */
 
@@ -219,10 +227,10 @@ replay:
                tp = kzalloc(sizeof(*tp), GFP_KERNEL);
                if (tp == NULL)
                        goto errout;
-               err = -EINVAL;
+               err = -ENOENT;
                tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
                if (tp_ops == NULL) {
-#ifdef CONFIG_KMOD
+#ifdef CONFIG_MODULES
                        struct nlattr *kind = tca[TCA_KIND];
                        char name[IFNAMSIZ];
 
@@ -249,7 +257,7 @@ replay:
                }
                tp->ops = tp_ops;
                tp->protocol = protocol;
-               tp->prio = nprio ? : tcf_auto_prio(*back);
+               tp->prio = nprio ? : TC_H_MAJ(tcf_auto_prio(*back));
                tp->q = q;
                tp->classify = tp_ops->classify;
                tp->classid = parent;
@@ -261,10 +269,7 @@ replay:
                        goto errout;
                }
 
-               qdisc_lock_tree(dev);
-               tp->next = *back;
-               *back = tp;
-               qdisc_unlock_tree(dev);
+               tp_created = 1;
 
        } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
                goto errout;
@@ -273,9 +278,9 @@ replay:
 
        if (fh == 0) {
                if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
-                       qdisc_lock_tree(dev);
+                       spin_lock_bh(root_lock);
                        *back = tp->next;
-                       qdisc_unlock_tree(dev);
+                       spin_unlock_bh(root_lock);
 
                        tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
                        tcf_destroy(tp);
@@ -291,8 +296,11 @@ replay:
                switch (n->nlmsg_type) {
                case RTM_NEWTFILTER:
                        err = -EEXIST;
-                       if (n->nlmsg_flags & NLM_F_EXCL)
+                       if (n->nlmsg_flags & NLM_F_EXCL) {
+                               if (tp_created)
+                                       tcf_destroy(tp);
                                goto errout;
+                       }
                        break;
                case RTM_DELTFILTER:
                        err = tp->ops->delete(tp, fh);
@@ -309,8 +317,18 @@ replay:
        }
 
        err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-       if (err == 0)
+       if (err == 0) {
+               if (tp_created) {
+                       spin_lock_bh(root_lock);
+                       tp->next = *back;
+                       *back = tp;
+                       spin_unlock_bh(root_lock);
+               }
                tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+       } else {
+               if (tp_created)
+                       tcf_destroy(tp);
+       }
 
 errout:
        if (cl)
@@ -332,11 +350,11 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
        tcm = NLMSG_DATA(nlh);
        tcm->tcm_family = AF_UNSPEC;
        tcm->tcm__pad1 = 0;
-       tcm->tcm__pad1 = 0;
-       tcm->tcm_ifindex = tp->q->dev->ifindex;
+       tcm->tcm__pad2 = 0;
+       tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
        tcm->tcm_parent = tp->classid;
        tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
-       NLA_PUT(skb, TCA_KIND, IFNAMSIZ, tp->ops->kind);
+       NLA_PUT_STRING(skb, TCA_KIND, tp->ops->kind);
        tcm->tcm_handle = fh;
        if (RTM_DELTFILTER != event) {
                tcm->tcm_handle = 0;
@@ -388,7 +406,7 @@ static int tcf_node_dump(struct tcf_proto *tp, unsigned long n,
 
 static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
 {
-       struct net *net = skb->sk->sk_net;
+       struct net *net = sock_net(skb->sk);
        int t;
        int s_t;
        struct net_device *dev;
@@ -408,13 +426,15 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
                return skb->len;
 
        if (!tcm->tcm_parent)
-               q = dev->qdisc_sleeping;
+               q = dev->qdisc;
        else
                q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
        if (!q)
                goto out;
        if ((cops = q->ops->cl_ops) == NULL)
                goto errout;
+       if (cops->tcf_chain == NULL)
+               goto errout;
        if (TC_H_MIN(tcm->tcm_parent)) {
                cl = cops->get(q, tcm->tcm_parent);
                if (cl == 0)
@@ -481,31 +501,28 @@ EXPORT_SYMBOL(tcf_exts_destroy);
 
 int tcf_exts_validate(struct tcf_proto *tp, struct nlattr **tb,
                  struct nlattr *rate_tlv, struct tcf_exts *exts,
-                 struct tcf_ext_map *map)
+                 const struct tcf_ext_map *map)
 {
        memset(exts, 0, sizeof(*exts));
 
 #ifdef CONFIG_NET_CLS_ACT
        {
-               int err;
                struct tc_action *act;
 
                if (map->police && tb[map->police]) {
-                       act = tcf_action_init_1((struct rtattr *)tb[map->police],
-                                               (struct rtattr *)rate_tlv,
+                       act = tcf_action_init_1(tb[map->police], rate_tlv,
                                                "police", TCA_ACT_NOREPLACE,
-                                               TCA_ACT_BIND, &err);
-                       if (act == NULL)
-                               return err;
+                                               TCA_ACT_BIND);
+                       if (IS_ERR(act))
+                               return PTR_ERR(act);
 
                        act->type = TCA_OLD_COMPAT;
                        exts->action = act;
                } else if (map->action && tb[map->action]) {
-                       act = tcf_action_init((struct rtattr *)tb[map->action],
-                                             (struct rtattr *)rate_tlv, NULL,
-                               TCA_ACT_NOREPLACE, TCA_ACT_BIND, &err);
-                       if (act == NULL)
-                               return err;
+                       act = tcf_action_init(tb[map->action], rate_tlv, NULL,
+                                             TCA_ACT_NOREPLACE, TCA_ACT_BIND);
+                       if (IS_ERR(act))
+                               return PTR_ERR(act);
 
                        exts->action = act;
                }
@@ -527,7 +544,8 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
        if (src->action) {
                struct tc_action *act;
                tcf_tree_lock(tp);
-               act = xchg(&dst->action, src->action);
+               act = dst->action;
+               dst->action = src->action;
                tcf_tree_unlock(tp);
                if (act)
                        tcf_action_destroy(act, TCA_ACT_UNBIND);
@@ -537,7 +555,7 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
 EXPORT_SYMBOL(tcf_exts_change);
 
 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
-             struct tcf_ext_map *map)
+                 const struct tcf_ext_map *map)
 {
 #ifdef CONFIG_NET_CLS_ACT
        if (map->action && exts->action) {
@@ -546,18 +564,22 @@ int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
                 * to work with both old and new modes of entering
                 * tc data even if iproute2  was newer - jhs
                 */
-               struct nlattr *p_rta = (struct nlattr *)skb_tail_pointer(skb);
+               struct nlattr *nest;
 
                if (exts->action->type != TCA_OLD_COMPAT) {
-                       NLA_PUT(skb, map->action, 0, NULL);
+                       nest = nla_nest_start(skb, map->action);
+                       if (nest == NULL)
+                               goto nla_put_failure;
                        if (tcf_action_dump(skb, exts->action, 0, 0) < 0)
                                goto nla_put_failure;
-                       p_rta->nla_len = skb_tail_pointer(skb) - (u8 *)p_rta;
+                       nla_nest_end(skb, nest);
                } else if (map->police) {
-                       NLA_PUT(skb, map->police, 0, NULL);
+                       nest = nla_nest_start(skb, map->police);
+                       if (nest == NULL)
+                               goto nla_put_failure;
                        if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0)
                                goto nla_put_failure;
-                       p_rta->nla_len = skb_tail_pointer(skb) - (u8 *)p_rta;
+                       nla_nest_end(skb, nest);
                }
        }
 #endif
@@ -569,7 +591,7 @@ EXPORT_SYMBOL(tcf_exts_dump);
 
 
 int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts,
-                       struct tcf_ext_map *map)
+                       const struct tcf_ext_map *map)
 {
 #ifdef CONFIG_NET_CLS_ACT
        if (exts->action)