[NETFILTER]: x_tables: small check_entry & module_refcount cleanup

[pandora-kernel.git] / net / ipv4 / netfilter / ip_tables.c

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index fc5bdd5..38e1e4f 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -180,8 +180,7 @@ ipt_error(struct sk_buff **pskb,
          const struct net_device *out,
          unsigned int hooknum,
          const struct xt_target *target,
-         const void *targinfo,
-         void *userinfo)
+         const void *targinfo)
 {
        if (net_ratelimit())
                printk("ip_tables: error: `%s'\n", (char *)targinfo);
@@ -217,8 +216,7 @@ ipt_do_table(struct sk_buff **pskb,
             unsigned int hook,
             const struct net_device *in,
             const struct net_device *out,
-            struct ipt_table *table,
-            void *userdata)
+            struct ipt_table *table)
 {
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
        u_int16_t offset;
@@ -230,7 +228,7 @@ ipt_do_table(struct sk_buff **pskb,
        const char *indev, *outdev;
        void *table_base;
        struct ipt_entry *e, *back;
-       struct xt_table_info *private = table->private;
+       struct xt_table_info *private;
 
        /* Initialization */
        ip = (*pskb)->nh.iph;
@@ -247,6 +245,7 @@ ipt_do_table(struct sk_buff **pskb,
 
        read_lock_bh(&table->lock);
        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+       private = table->private;
        table_base = (void *)private->entries[smp_processor_id()];
        e = get_entry(table_base, private->hook_entry[hook]);
 
@@ -307,8 +306,7 @@ ipt_do_table(struct sk_buff **pskb,
                                                                     in, out,
                                                                     hook,
                                                                     t->u.kernel.target,
-                                                                    t->data,
-                                                                    userdata);
+                                                                    t->data);
 
 #ifdef CONFIG_NETFILTER_DEBUG
                                if (((struct ipt_entry *)table_base)->comefrom
@@ -466,8 +464,7 @@ cleanup_match(struct ipt_entry_match *m, unsigned int *i)
                return 1;
 
        if (m->u.kernel.match->destroy)
-               m->u.kernel.match->destroy(m->u.kernel.match, m->data,
-                                          m->u.match_size - sizeof(*m));
+               m->u.kernel.match->destroy(m->u.kernel.match, m->data);
        module_put(m->u.kernel.match->me);
        return 0;
 }
@@ -520,7 +517,6 @@ check_match(struct ipt_entry_match *m,
 
        if (m->u.kernel.match->checkentry
            && !m->u.kernel.match->checkentry(name, ip, match, m->data,
-                                             m->u.match_size - sizeof(*m),
                                              hookmask)) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         m->u.kernel.match->name);
@@ -577,12 +573,10 @@ check_entry(struct ipt_entry *e, const char *name, unsigned int size,
        if (t->u.kernel.target == &ipt_standard_target) {
                if (!standard_check(t, size)) {
                        ret = -EINVAL;
-                       goto cleanup_matches;
+                       goto err;
                }
        } else if (t->u.kernel.target->checkentry
                   && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                                     t->u.target_size
-                                                     - sizeof(*t),
                                                      e->comefrom)) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);
@@ -654,8 +648,7 @@ cleanup_entry(struct ipt_entry *e, unsigned int *i)
        IPT_MATCH_ITERATE(e, cleanup_match, NULL);
        t = ipt_get_target(e);
        if (t->u.kernel.target->destroy)
-               t->u.kernel.target->destroy(t->u.kernel.target, t->data,
-                                           t->u.target_size - sizeof(*t));
+               t->u.kernel.target->destroy(t->u.kernel.target, t->data);
        module_put(t->u.kernel.target->me);
        return 0;
 }
@@ -1601,7 +1594,6 @@ static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
 
        if (m->u.kernel.match->checkentry
            && !m->u.kernel.match->checkentry(name, ip, match, dm->data,
-                                             dm->u.match_size - sizeof(*dm),
                                              hookmask)) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         m->u.kernel.match->name);
@@ -1660,8 +1652,7 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
                        goto out;
        } else if (t->u.kernel.target->checkentry
                   && !t->u.kernel.target->checkentry(name, de, target,
-                               t->data, t->u.target_size - sizeof(*t),
-                               de->comefrom)) {
+                                                     t->data, de->comefrom)) {
                duprintf("ip_tables: compat: check failed for `%s'.\n",
                         t->u.kernel.target->name);
                goto out;
@@ -2184,7 +2175,6 @@ icmp_checkentry(const char *tablename,
           const void *info,
           const struct xt_match *match,
           void *matchinfo,
-          unsigned int matchsize,
           unsigned int hook_mask)
 {
        const struct ipt_icmp *icmpinfo = matchinfo;
@@ -2239,22 +2229,39 @@ static int __init ip_tables_init(void)
 {
        int ret;
 
-       xt_proto_init(AF_INET);
+       ret = xt_proto_init(AF_INET);
+       if (ret < 0)
+               goto err1;
 
        /* Noone else will be downing sem now, so we won't sleep */
-       xt_register_target(&ipt_standard_target);
-       xt_register_target(&ipt_error_target);
-       xt_register_match(&icmp_matchstruct);
+       ret = xt_register_target(&ipt_standard_target);
+       if (ret < 0)
+               goto err2;
+       ret = xt_register_target(&ipt_error_target);
+       if (ret < 0)
+               goto err3;
+       ret = xt_register_match(&icmp_matchstruct);
+       if (ret < 0)
+               goto err4;
 
        /* Register setsockopt */
        ret = nf_register_sockopt(&ipt_sockopts);
-       if (ret < 0) {
-               duprintf("Unable to register sockopts.\n");
-               return ret;
-       }
+       if (ret < 0)
+               goto err5;
 
        printk("ip_tables: (C) 2000-2006 Netfilter Core Team\n");
        return 0;
+
+err5:
+       xt_unregister_match(&icmp_matchstruct);
+err4:
+       xt_unregister_target(&ipt_error_target);
+err3:
+       xt_unregister_target(&ipt_standard_target);
+err2:
+       xt_proto_fini(AF_INET);
+err1:
+       return ret;
 }
 
 static void __exit ip_tables_fini(void)