pkt_sched: cls_u32: Fix locking in u32_change()

[pandora-kernel.git] / net / sched / cls_u32.c

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 4d75544..ea51fcd 100644 (file)
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -75,7 +75,6 @@ struct tc_u_hnode
 
 struct tc_u_common
 {
-       struct tc_u_common      *next;
        struct tc_u_hnode       *hlist;
        struct Qdisc            *q;
        int                     refcnt;
@@ -87,8 +86,6 @@ static const struct tcf_ext_map u32_ext_map = {
        .police = TCA_U32_POLICE
 };
 
-static struct tc_u_common *u32_list;
-
 static __inline__ unsigned u32_hash_fold(__be32 key, struct tc_u32_sel *sel, u8 fshift)
 {
        unsigned h = ntohl(key & sel->hmask)>>fshift;
@@ -287,9 +284,7 @@ static int u32_init(struct tcf_proto *tp)
        struct tc_u_hnode *root_ht;
        struct tc_u_common *tp_c;
 
-       for (tp_c = u32_list; tp_c; tp_c = tp_c->next)
-               if (tp_c->q == tp->q)
-                       break;
+       tp_c = tp->q->u32_node;
 
        root_ht = kzalloc(sizeof(*root_ht), GFP_KERNEL);
        if (root_ht == NULL)
@@ -307,8 +302,7 @@ static int u32_init(struct tcf_proto *tp)
                        return -ENOBUFS;
                }
                tp_c->q = tp->q;
-               tp_c->next = u32_list;
-               u32_list = tp_c;
+               tp->q->u32_node = tp_c;
        }
 
        tp_c->refcnt++;
@@ -351,7 +345,7 @@ static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode* key)
                        }
                }
        }
-       BUG_TRAP(0);
+       WARN_ON(1);
        return 0;
 }
 
@@ -374,7 +368,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
        struct tc_u_common *tp_c = tp->data;
        struct tc_u_hnode **hn;
 
-       BUG_TRAP(!ht->refcnt);
+       WARN_ON(ht->refcnt);
 
        u32_clear_hnode(tp, ht);
 
@@ -386,7 +380,7 @@ static int u32_destroy_hnode(struct tcf_proto *tp, struct tc_u_hnode *ht)
                }
        }
 
-       BUG_TRAP(0);
+       WARN_ON(1);
        return -ENOENT;
 }
 
@@ -395,21 +389,15 @@ static void u32_destroy(struct tcf_proto *tp)
        struct tc_u_common *tp_c = tp->data;
        struct tc_u_hnode *root_ht = xchg(&tp->root, NULL);
 
-       BUG_TRAP(root_ht != NULL);
+       WARN_ON(root_ht == NULL);
 
        if (root_ht && --root_ht->refcnt == 0)
                u32_destroy_hnode(tp, root_ht);
 
        if (--tp_c->refcnt == 0) {
                struct tc_u_hnode *ht;
-               struct tc_u_common **tp_cp;
 
-               for (tp_cp = &u32_list; *tp_cp; tp_cp = &(*tp_cp)->next) {
-                       if (*tp_cp == tp_c) {
-                               *tp_cp = tp_c->next;
-                               break;
-                       }
-               }
+               tp->q->u32_node = NULL;
 
                for (ht = tp_c->hlist; ht; ht = ht->next) {
                        ht->refcnt--;
@@ -419,7 +407,7 @@ static void u32_destroy(struct tcf_proto *tp)
                while ((ht = tp_c->hlist) != NULL) {
                        tp_c->hlist = ht->next;
 
-                       BUG_TRAP(ht->refcnt == 0);
+                       WARN_ON(ht->refcnt != 0);
 
                        kfree(ht);
                }
@@ -649,8 +637,9 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
                                break;
 
                n->next = *ins;
-               wmb();
+               tcf_tree_lock(tp);
                *ins = n;
+               tcf_tree_unlock(tp);
 
                *arg = (unsigned long)n;
                return 0;