Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  appletalk: Fix OOPS in atalk_release().
  mlx4: Fixing bad size of event queue buffer
  mlx4: Fixing use after free
  bonding:typo in comment
  sctp: Pass __GFP_NOWARN to hash table allocation attempts.
  connector: convert to synchronous netlink message processing
  fib: add rtnl locking in ip_fib_net_exit
  atm/solos-pci: Don't flap VCs when carrier state changes
  atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
  atm/solos-pci: Use VPI.VCI notation uniformly.
  Atheros, atl2: Fix mem leaks in error paths of atl2_set_eeprom
  netdev: fix mtu check when TSO is enabled
  net/usb: Ethernet quirks for the LG-VL600 4G modem
  phylib: phy_attach_direct: phy_init_hw can fail, add cleanup
  bridge: mcast snooping, fix length check of snooped MLDv1/2
  via-ircc: Pass PCI device pointer to dma_{alloc, free}_coherent()
  via-ircc: Use pci_{get, set}_drvdata() instead of static pointer variable
  net: gre: provide multicast mappings for ipv4 and ipv6
  bridge: Fix compilation warning in function br_stp_recalculate_bridge_id()
  net: Fix warnings caused by MAX_SKB_FRAGS change.

1 files changed, 17 insertions, 41 deletions

diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index 55653aba6735..c42c9d517790 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -31,24 +31,9 @@
 #include <linux/connector.h>
 #include <linux/delay.h>
 
-void cn_queue_wrapper(struct work_struct *work)
-{
-        struct cn_callback_entry *cbq =
-                container_of(work, struct cn_callback_entry, work);
-        struct cn_callback_data *d = &cbq->data;
-        struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
-        struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb);
-
-        d->callback(msg, nsp);
-
-        kfree_skb(d->skb);
-        d->skb = NULL;
-
-        kfree(d->free);
-}
-
 static struct cn_callback_entry *
-cn_queue_alloc_callback_entry(const char *name, struct cb_id *id,
+cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const char *name,
+                              struct cb_id *id,
                               void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
 {
         struct cn_callback_entry *cbq;
@@ -59,17 +44,23 @@ cn_queue_alloc_callback_entry(const char *name, struct cb_id *id,
                 return NULL;
         }
 
+        atomic_set(&cbq->refcnt, 1);
+
+        atomic_inc(&dev->refcnt);
+        cbq->pdev = dev;
+
         snprintf(cbq->id.name, sizeof(cbq->id.name), "%s", name);
         memcpy(&cbq->id.id, id, sizeof(struct cb_id));
-        cbq->data.callback = callback;
-
-        INIT_WORK(&cbq->work, &cn_queue_wrapper);
+        cbq->callback = callback;
         return cbq;
 }
 
-static void cn_queue_free_callback(struct cn_callback_entry *cbq)
+void cn_queue_release_callback(struct cn_callback_entry *cbq)
 {
-        flush_workqueue(cbq->pdev->cn_queue);
+        if (!atomic_dec_and_test(&cbq->refcnt))
+                return;
+
+        atomic_dec(&cbq->pdev->refcnt);
         kfree(cbq);
 }
 
@@ -85,13 +76,10 @@ int cn_queue_add_callback(struct cn_queue_dev *dev, const char *name,
         struct cn_callback_entry *cbq, *__cbq;
         int found = 0;
 
-        cbq = cn_queue_alloc_callback_entry(name, id, callback);
+        cbq = cn_queue_alloc_callback_entry(dev, name, id, callback);
         if (!cbq)
                 return -ENOMEM;
 
-        atomic_inc(&dev->refcnt);
-        cbq->pdev = dev;
-
         spin_lock_bh(&dev->queue_lock);
         list_for_each_entry(__cbq, &dev->queue_list, callback_entry) {
                 if (cn_cb_equal(&__cbq->id.id, id)) {
@@ -104,8 +92,7 @@ int cn_queue_add_callback(struct cn_queue_dev *dev, const char *name,
         spin_unlock_bh(&dev->queue_lock);
 
         if (found) {
-                cn_queue_free_callback(cbq);
-                atomic_dec(&dev->refcnt);
+                cn_queue_release_callback(cbq);
                 return -EINVAL;
         }
 
@@ -130,10 +117,8 @@ void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id)
         }
         spin_unlock_bh(&dev->queue_lock);
 
-        if (found) {
-                cn_queue_free_callback(cbq);
-                atomic_dec(&dev->refcnt);
-        }
+        if (found)
+                cn_queue_release_callback(cbq);
 }
 
 struct cn_queue_dev *cn_queue_alloc_dev(const char *name, struct sock *nls)
@@ -151,12 +136,6 @@ struct cn_queue_dev *cn_queue_alloc_dev(const char *name, struct sock *nls)
 
         dev->nls = nls;
 
-        dev->cn_queue = alloc_ordered_workqueue(dev->name, 0);
-        if (!dev->cn_queue) {
-                kfree(dev);
-                return NULL;
-        }
-
         return dev;
 }
 
@@ -164,9 +143,6 @@ void cn_queue_free_dev(struct cn_queue_dev *dev)
 {
         struct cn_callback_entry *cbq, *n;
 
-        flush_workqueue(dev->cn_queue);
-        destroy_workqueue(dev->cn_queue);
-
         spin_lock_bh(&dev->queue_lock);
         list_for_each_entry_safe(cbq, n, &dev->queue_list, callback_entry)
                 list_del(&cbq->callback_entry);