orinoco: fix unsafe locking in orinoco_cs_resume

[safe/jmp/linux-2.6] / net / sched / sch_red.c

diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 2be563c..5da0583 100644 (file)
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -14,11 +14,9 @@
  * J Hadi Salim 980816:  ECN support
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/pkt_sched.h>
 #include <net/inet_ecn.h>
@@ -94,12 +92,12 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                        break;
        }
 
-       ret = child->enqueue(skb, child);
+       ret = qdisc_enqueue(skb, child);
        if (likely(ret == NET_XMIT_SUCCESS)) {
-               sch->bstats.bytes += skb->len;
+               sch->bstats.bytes += qdisc_pkt_len(skb);
                sch->bstats.packets++;
                sch->q.qlen++;
-       } else {
+       } else if (net_xmit_drop_count(ret)) {
                q->stats.pdrop++;
                sch->qstats.drops++;
        }
@@ -176,64 +174,49 @@ static void red_destroy(struct Qdisc *sch)
        qdisc_destroy(q->qdisc);
 }
 
-static struct Qdisc *red_create_dflt(struct net_device *dev, u32 limit)
-{
-       struct Qdisc *q = qdisc_create_dflt(dev, &bfifo_qdisc_ops);
-       struct rtattr *rta;
-       int ret;
-
-       if (q) {
-               rta = kmalloc(RTA_LENGTH(sizeof(struct tc_fifo_qopt)),
-                             GFP_KERNEL);
-               if (rta) {
-                       rta->rta_type = RTM_NEWQDISC;
-                       rta->rta_len = RTA_LENGTH(sizeof(struct tc_fifo_qopt));
-                       ((struct tc_fifo_qopt *)RTA_DATA(rta))->limit = limit;
-
-                       ret = q->ops->change(q, rta);
-                       kfree(rta);
-
-                       if (ret == 0)
-                               return q;
-               }
-               qdisc_destroy(q);
-       }
-       return NULL;
-}
+static const struct nla_policy red_policy[TCA_RED_MAX + 1] = {
+       [TCA_RED_PARMS] = { .len = sizeof(struct tc_red_qopt) },
+       [TCA_RED_STAB]  = { .len = RED_STAB_SIZE },
+};
 
-static int red_change(struct Qdisc *sch, struct rtattr *opt)
+static int red_change(struct Qdisc *sch, struct nlattr *opt)
 {
        struct red_sched_data *q = qdisc_priv(sch);
-       struct rtattr *tb[TCA_RED_MAX];
+       struct nlattr *tb[TCA_RED_MAX + 1];
        struct tc_red_qopt *ctl;
        struct Qdisc *child = NULL;
+       int err;
 
-       if (opt == NULL || rtattr_parse_nested(tb, TCA_RED_MAX, opt))
+       if (opt == NULL)
                return -EINVAL;
 
-       if (tb[TCA_RED_PARMS-1] == NULL ||
-           RTA_PAYLOAD(tb[TCA_RED_PARMS-1]) < sizeof(*ctl) ||
-           tb[TCA_RED_STAB-1] == NULL ||
-           RTA_PAYLOAD(tb[TCA_RED_STAB-1]) < RED_STAB_SIZE)
+       err = nla_parse_nested(tb, TCA_RED_MAX, opt, red_policy);
+       if (err < 0)
+               return err;
+
+       if (tb[TCA_RED_PARMS] == NULL ||
+           tb[TCA_RED_STAB] == NULL)
                return -EINVAL;
 
-       ctl = RTA_DATA(tb[TCA_RED_PARMS-1]);
+       ctl = nla_data(tb[TCA_RED_PARMS]);
 
        if (ctl->limit > 0) {
-               child = red_create_dflt(sch->dev, ctl->limit);
-               if (child == NULL)
-                       return -ENOMEM;
+               child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit);
+               if (IS_ERR(child))
+                       return PTR_ERR(child);
        }
 
        sch_tree_lock(sch);
        q->flags = ctl->flags;
        q->limit = ctl->limit;
-       if (child)
+       if (child) {
+               qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
                qdisc_destroy(xchg(&q->qdisc, child));
+       }
 
        red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog,
                                 ctl->Plog, ctl->Scell_log,
-                                RTA_DATA(tb[TCA_RED_STAB-1]));
+                                nla_data(tb[TCA_RED_STAB]));
 
        if (skb_queue_empty(&sch->q))
                red_end_of_idle_period(&q->parms);
@@ -242,7 +225,7 @@ static int red_change(struct Qdisc *sch, struct rtattr *opt)
        return 0;
 }
 
-static int red_init(struct Qdisc* sch, struct rtattr *opt)
+static int red_init(struct Qdisc* sch, struct nlattr *opt)
 {
        struct red_sched_data *q = qdisc_priv(sch);
 
@@ -253,7 +236,7 @@ static int red_init(struct Qdisc* sch, struct rtattr *opt)
 static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
        struct red_sched_data *q = qdisc_priv(sch);
-       struct rtattr *opts = NULL;
+       struct nlattr *opts = NULL;
        struct tc_red_qopt opt = {
                .limit          = q->limit,
                .flags          = q->flags,
@@ -264,12 +247,15 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
                .Scell_log      = q->parms.Scell_log,
        };
 
-       opts = RTA_NEST(skb, TCA_OPTIONS);
-       RTA_PUT(skb, TCA_RED_PARMS, sizeof(opt), &opt);
-       return RTA_NEST_END(skb, opts);
+       opts = nla_nest_start(skb, TCA_OPTIONS);
+       if (opts == NULL)
+               goto nla_put_failure;
+       NLA_PUT(skb, TCA_RED_PARMS, sizeof(opt), &opt);
+       return nla_nest_end(skb, opts);
 
-rtattr_failure:
-       return RTA_NEST_CANCEL(skb, opts);
+nla_put_failure:
+       nla_nest_cancel(skb, opts);
+       return -EMSGSIZE;
 }
 
 static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
@@ -307,8 +293,8 @@ static int red_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 
        sch_tree_lock(sch);
        *old = xchg(&q->qdisc, new);
+       qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
        qdisc_reset(*old);
-       sch->q.qlen = 0;
        sch_tree_unlock(sch);
        return 0;
 }
@@ -330,7 +316,7 @@ static void red_put(struct Qdisc *sch, unsigned long arg)
 }
 
 static int red_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
-                           struct rtattr **tca, unsigned long *arg)
+                           struct nlattr **tca, unsigned long *arg)
 {
        return -ENOSYS;
 }
@@ -357,7 +343,7 @@ static struct tcf_proto **red_find_tcf(struct Qdisc *sch, unsigned long cl)
        return NULL;
 }
 
-static struct Qdisc_class_ops red_class_ops = {
+static const struct Qdisc_class_ops red_class_ops = {
        .graft          =       red_graft,
        .leaf           =       red_leaf,
        .get            =       red_get,
@@ -369,7 +355,7 @@ static struct Qdisc_class_ops red_class_ops = {
        .dump           =       red_dump_class,
 };
 
-static struct Qdisc_ops red_qdisc_ops = {
+static struct Qdisc_ops red_qdisc_ops __read_mostly = {
        .id             =       "red",
        .priv_size      =       sizeof(struct red_sched_data),
        .cl_ops         =       &red_class_ops,