net_sched: sch_hfsc: fix classification loops

[safe/jmp/linux-2.6] / net / sched / cls_fw.c

diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 61ebe25..93b0a7b 100644 (file)
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -47,7 +48,7 @@ struct fw_filter
        struct tcf_exts         exts;
 };
 
-static struct tcf_ext_map fw_ext_map = {
+static const struct tcf_ext_map fw_ext_map = {
        .action = TCA_FW_ACT,
        .police = TCA_FW_POLICE
 };
@@ -148,7 +149,7 @@ fw_delete_filter(struct tcf_proto *tp, struct fw_filter *f)
 
 static void fw_destroy(struct tcf_proto *tp)
 {
-       struct fw_head *head = (struct fw_head*)xchg(&tp->root, NULL);
+       struct fw_head *head = tp->root;
        struct fw_filter *f;
        int h;
 
@@ -186,6 +187,12 @@ out:
        return -EINVAL;
 }
 
+static const struct nla_policy fw_policy[TCA_FW_MAX + 1] = {
+       [TCA_FW_CLASSID]        = { .type = NLA_U32 },
+       [TCA_FW_INDEV]          = { .type = NLA_STRING, .len = IFNAMSIZ },
+       [TCA_FW_MASK]           = { .type = NLA_U32 },
+};
+
 static int
 fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
        struct nlattr **tb, struct nlattr **tca, unsigned long base)
@@ -201,9 +208,7 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
 
        err = -EINVAL;
        if (tb[TCA_FW_CLASSID]) {
-               if (nla_len(tb[TCA_FW_CLASSID]) != sizeof(u32))
-                       goto errout;
-               f->res.classid = *(u32*)nla_data(tb[TCA_FW_CLASSID]);
+               f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
                tcf_bind_filter(tp, &f->res, base);
        }
 
@@ -216,9 +221,7 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
 #endif /* CONFIG_NET_CLS_IND */
 
        if (tb[TCA_FW_MASK]) {
-               if (nla_len(tb[TCA_FW_MASK]) != sizeof(u32))
-                       goto errout;
-               mask = *(u32*)nla_data(tb[TCA_FW_MASK]);
+               mask = nla_get_u32(tb[TCA_FW_MASK]);
                if (mask != head->mask)
                        goto errout;
        } else if (head->mask != 0xFFFFFFFF)
@@ -246,7 +249,7 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
        if (!opt)
                return handle ? -EINVAL : 0;
 
-       err = nla_parse_nested(tb, TCA_FW_MAX, opt, NULL);
+       err = nla_parse_nested(tb, TCA_FW_MAX, opt, fw_policy);
        if (err < 0)
                return err;
 
@@ -261,11 +264,8 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
 
        if (head == NULL) {
                u32 mask = 0xFFFFFFFF;
-               if (tb[TCA_FW_MASK]) {
-                       if (nla_len(tb[TCA_FW_MASK]) != sizeof(u32))
-                               return -EINVAL;
-                       mask = *(u32*)nla_data(tb[TCA_FW_MASK]);
-               }
+               if (tb[TCA_FW_MASK])
+                       mask = nla_get_u32(tb[TCA_FW_MASK]);
 
                head = kzalloc(sizeof(struct fw_head), GFP_KERNEL);
                if (head == NULL)