netns xfrm: per-netns xfrm_policy_byidx hash

[safe/jmp/linux-2.6] / net / xfrm / xfrm_policy.c

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cf2bf3a..700cdd7 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -46,7 +46,6 @@ EXPORT_SYMBOL(xfrm_cfg_mutex);
 
 static DEFINE_RWLOCK(xfrm_policy_lock);
 
-static struct list_head xfrm_policy_all;
 unsigned int xfrm_policy_count[XFRM_POLICY_MAX*2];
 EXPORT_SYMBOL(xfrm_policy_count);
 
@@ -228,13 +227,14 @@ expired:
  * SPD calls.
  */
 
-struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp)
+struct xfrm_policy *xfrm_policy_alloc(struct net *net, gfp_t gfp)
 {
        struct xfrm_policy *policy;
 
        policy = kzalloc(sizeof(struct xfrm_policy), gfp);
 
        if (policy) {
+               write_pnet(&policy->xp_net, net);
                INIT_LIST_HEAD(&policy->walk.all);
                INIT_HLIST_NODE(&policy->bydst);
                INIT_HLIST_NODE(&policy->byidx);
@@ -329,7 +329,6 @@ struct xfrm_policy_hash {
 
 static struct hlist_head xfrm_policy_inexact[XFRM_POLICY_MAX*2];
 static struct xfrm_policy_hash xfrm_policy_bydst[XFRM_POLICY_MAX*2] __read_mostly;
-static struct hlist_head *xfrm_policy_byidx __read_mostly;
 static unsigned int xfrm_idx_hmask __read_mostly;
 static unsigned int xfrm_policy_hashmax __read_mostly = 1 * 1024 * 1024;
 
@@ -438,7 +437,7 @@ static void xfrm_byidx_resize(int total)
        unsigned int hmask = xfrm_idx_hmask;
        unsigned int nhashmask = xfrm_new_hash_mask(hmask);
        unsigned int nsize = (nhashmask + 1) * sizeof(struct hlist_head);
-       struct hlist_head *oidx = xfrm_policy_byidx;
+       struct hlist_head *oidx = init_net.xfrm.policy_byidx;
        struct hlist_head *nidx = xfrm_hash_alloc(nsize);
        int i;
 
@@ -450,7 +449,7 @@ static void xfrm_byidx_resize(int total)
        for (i = hmask; i >= 0; i--)
                xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);
 
-       xfrm_policy_byidx = nidx;
+       init_net.xfrm.policy_byidx = nidx;
        xfrm_idx_hmask = nhashmask;
 
        write_unlock_bh(&xfrm_policy_lock);
@@ -536,7 +535,7 @@ static u32 xfrm_gen_index(int dir)
                idx_generator += 8;
                if (idx == 0)
                        idx = 8;
-               list = xfrm_policy_byidx + idx_hash(idx);
+               list = init_net.xfrm.policy_byidx + idx_hash(idx);
                found = 0;
                hlist_for_each_entry(p, entry, list, byidx) {
                        if (p->index == idx) {
@@ -609,12 +608,12 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                xfrm_policy_count[dir]--;
        }
        policy->index = delpol ? delpol->index : xfrm_gen_index(dir);
-       hlist_add_head(&policy->byidx, xfrm_policy_byidx+idx_hash(policy->index));
+       hlist_add_head(&policy->byidx, init_net.xfrm.policy_byidx+idx_hash(policy->index));
        policy->curlft.add_time = get_seconds();
        policy->curlft.use_time = 0;
        if (!mod_timer(&policy->timer, jiffies + HZ))
                xfrm_pol_hold(policy);
-       list_add(&policy->walk.all, &xfrm_policy_all);
+       list_add(&policy->walk.all, &init_net.xfrm.policy_all);
        write_unlock_bh(&xfrm_policy_lock);
 
        if (delpol)
@@ -711,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
 
        *err = 0;
        write_lock_bh(&xfrm_policy_lock);
-       chain = xfrm_policy_byidx + idx_hash(id);
+       chain = init_net.xfrm.policy_byidx + idx_hash(id);
        ret = NULL;
        hlist_for_each_entry(pol, entry, chain, byidx) {
                if (pol->type == type && pol->index == id) {
@@ -880,10 +879,10 @@ int xfrm_policy_walk(struct xfrm_policy_walk *walk,
 
        write_lock_bh(&xfrm_policy_lock);
        if (list_empty(&walk->walk.all))
-               x = list_first_entry(&xfrm_policy_all, struct xfrm_policy_walk_entry, all);
+               x = list_first_entry(&init_net.xfrm.policy_all, struct xfrm_policy_walk_entry, all);
        else
                x = list_entry(&walk->walk.all, struct xfrm_policy_walk_entry, all);
-       list_for_each_entry_from(x, &xfrm_policy_all, all) {
+       list_for_each_entry_from(x, &init_net.xfrm.policy_all, all) {
                if (x->dead)
                        continue;
                pol = container_of(x, struct xfrm_policy, walk);
@@ -1085,9 +1084,9 @@ static void __xfrm_policy_link(struct xfrm_policy *pol, int dir)
        struct hlist_head *chain = policy_hash_bysel(&pol->selector,
                                                     pol->family, dir);
 
-       list_add(&pol->walk.all, &xfrm_policy_all);
+       list_add(&pol->walk.all, &init_net.xfrm.policy_all);
        hlist_add_head(&pol->bydst, chain);
-       hlist_add_head(&pol->byidx, xfrm_policy_byidx+idx_hash(pol->index));
+       hlist_add_head(&pol->byidx, init_net.xfrm.policy_byidx+idx_hash(pol->index));
        xfrm_policy_count[dir]++;
        xfrm_pol_hold(pol);
 
@@ -1153,7 +1152,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
 
 static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
 {
-       struct xfrm_policy *newp = xfrm_policy_alloc(GFP_ATOMIC);
+       struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC);
 
        if (newp) {
                newp->selector = old->selector;
@@ -2408,10 +2407,10 @@ static int __net_init xfrm_policy_init(struct net *net)
        hmask = 8 - 1;
        sz = (hmask+1) * sizeof(struct hlist_head);
 
-       xfrm_policy_byidx = xfrm_hash_alloc(sz);
+       net->xfrm.policy_byidx = xfrm_hash_alloc(sz);
+       if (!net->xfrm.policy_byidx)
+               goto out_byidx;
        xfrm_idx_hmask = hmask;
-       if (!xfrm_policy_byidx)
-               panic("XFRM: failed to allocate byidx hash\n");
 
        for (dir = 0; dir < XFRM_POLICY_MAX * 2; dir++) {
                struct xfrm_policy_hash *htab;
@@ -2425,14 +2424,24 @@ static int __net_init xfrm_policy_init(struct net *net)
                        panic("XFRM: failed to allocate bydst hash\n");
        }
 
-       INIT_LIST_HEAD(&xfrm_policy_all);
+       INIT_LIST_HEAD(&net->xfrm.policy_all);
        if (net_eq(net, &init_net))
                register_netdevice_notifier(&xfrm_dev_notifier);
        return 0;
+
+out_byidx:
+       return -ENOMEM;
 }
 
 static void xfrm_policy_fini(struct net *net)
 {
+       unsigned int sz;
+
+       WARN_ON(!list_empty(&net->xfrm.policy_all));
+
+       sz = (xfrm_idx_hmask + 1) * sizeof(struct hlist_head);
+       WARN_ON(!hlist_empty(net->xfrm.policy_byidx));
+       xfrm_hash_free(net->xfrm.policy_byidx, sz);
 }
 
 static int __net_init xfrm_net_init(struct net *net)