6 files changed, 315 insertions, 170 deletions

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 3a66546cad0..e35d907fba2 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -47,6 +47,10 @@ static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout);
 #define dprintk(args...)
 #endif
 
+/* Maybe we'll add some more in the future. */
+#define LLC_CMSG_PKTINFO        1
+
+
 /**
  *      llc_ui_next_link_no - return the next unused link number for a sap
  *      @sap: Address of sap to get link number from.
@@ -136,6 +140,7 @@ static struct proto llc_proto = {
         .name     = "LLC",
         .owner    = THIS_MODULE,
         .obj_size = sizeof(struct llc_sock),
+        .slab_flags = SLAB_DESTROY_BY_RCU,
 };
 
 /**
@@ -192,10 +197,8 @@ static int llc_ui_release(struct socket *sock)
                 llc->laddr.lsap, llc->daddr.lsap);
         if (!llc_send_disc(sk))
                 llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        if (!sock_flag(sk, SOCK_ZAPPED)) {
-                llc_sap_put(llc->sap);
+        if (!sock_flag(sk, SOCK_ZAPPED))
                 llc_sap_remove_socket(llc->sap, sk);
-        }
         release_sock(sk);
         if (llc->dev)
                 dev_put(llc->dev);
@@ -255,7 +258,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         rc = -ENODEV;
-        llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev && addr->sllc_arphrd != llc->dev->type) {
+                        dev_put(llc->dev);
+                        llc->dev = NULL;
+                }
+        } else
+                llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
         if (!llc->dev)
                 goto out;
         rc = -EUSERS;
@@ -306,7 +316,25 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 goto out;
         rc = -ENODEV;
         rtnl_lock();
-        llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, addr->sllc_mac);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev) {
+                        if (!addr->sllc_arphrd)
+                                addr->sllc_arphrd = llc->dev->type;
+                        if (llc_mac_null(addr->sllc_mac))
+                                memcpy(addr->sllc_mac, llc->dev->dev_addr,
+                                       IFHWADDRLEN);
+                        if (addr->sllc_arphrd != llc->dev->type ||
+                            !llc_mac_match(addr->sllc_mac,
+                                           llc->dev->dev_addr)) {
+                                rc = -EINVAL;
+                                dev_put(llc->dev);
+                                llc->dev = NULL;
+                        }
+                }
+        } else
+                llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
+                                           addr->sllc_mac);
         rtnl_unlock();
         if (!llc->dev)
                 goto out;
@@ -322,7 +350,6 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 rc = -EBUSY; /* some other network layer is using the sap */
                 if (!sap)
                         goto out;
-                llc_sap_hold(sap);
         } else {
                 struct llc_addr laddr, daddr;
                 struct sock *ask;
@@ -591,6 +618,20 @@ static int llc_wait_data(struct sock *sk, long timeo)
         return rc;
 }
 
+static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
+{
+        struct llc_sock *llc = llc_sk(skb->sk);
+
+        if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
+                struct llc_pktinfo info;
+
+                info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
+                llc_pdu_decode_dsap(skb, &info.lpi_sap);
+                llc_pdu_decode_da(skb, info.lpi_mac);
+                put_cmsg(msg, SOL_LLC, LLC_OPT_PKTINFO, sizeof(info), &info);
+        }
+}
+
 /**
  *      llc_ui_accept - accept a new incoming connection.
  *      @sock: Socket which connections arrive on.
@@ -812,6 +853,8 @@ copy_uaddr:
                 memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
                 msg->msg_namelen = sizeof(*uaddr);
         }
+        if (llc_sk(sk)->cmsg_flags)
+                llc_cmsg_rcv(msg, skb);
         goto out;
 }
 
@@ -1030,6 +1073,12 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
                         goto out;
                 llc->rw = opt;
                 break;
+        case LLC_OPT_PKTINFO:
+                if (opt)
+                        llc->cmsg_flags |= LLC_CMSG_PKTINFO;
+                else
+                        llc->cmsg_flags &= ~LLC_CMSG_PKTINFO;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
@@ -1083,6 +1132,9 @@ static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
                 val = llc->k;                           break;
         case LLC_OPT_RX_WIN:
                 val = llc->rw;                          break;
+        case LLC_OPT_PKTINFO:
+                val = (llc->cmsg_flags & LLC_CMSG_PKTINFO) != 0;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index c6bab39b018..a8dde9b010d 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -468,6 +468,19 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
         return rc;
 }
 
+static inline bool llc_estab_match(const struct llc_sap *sap,
+                                   const struct llc_addr *daddr,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return llc->laddr.lsap == laddr->lsap &&
+                llc->daddr.lsap == daddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac) &&
+                llc_mac_match(llc->daddr.mac, daddr->mac);
+}
+
 /**
  *      __llc_lookup_established - Finds connection for the remote/local sap/mac
  *      @sap: SAP
@@ -484,23 +497,35 @@ static struct sock *__llc_lookup_established(struct llc_sap *sap,
                                              struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (llc->laddr.lsap == laddr->lsap &&
-                    llc->daddr.lsap == daddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                    llc_mac_match(llc->daddr.mac, daddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_estab_match(sap, daddr, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_estab_match(sap, daddr, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock(&sap->sk_list.lock);
+        rcu_read_unlock();
         return rc;
 }
 
@@ -516,6 +541,53 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
         return sk;
 }
 
+static inline bool llc_listener_match(const struct llc_sap *sap,
+                                      const struct llc_addr *laddr,
+                                      const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
+                llc->laddr.lsap == laddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
+static struct sock *__llc_lookup_listener(struct llc_sap *sap,
+                                          struct llc_addr *laddr)
+{
+        struct sock *rc;
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_listener_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_listener_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
+                        goto found;
+                }
+        }
+        rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
+found:
+        rcu_read_unlock();
+        return rc;
+}
+
 /**
  *      llc_lookup_listener - Finds listener for local MAC + SAP
  *      @sap: SAP
@@ -529,24 +601,12 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
 static struct sock *llc_lookup_listener(struct llc_sap *sap,
                                         struct llc_addr *laddr)
 {
-        struct sock *rc;
-        struct hlist_node *node;
+        static struct llc_addr null_addr;
+        struct sock *rc = __llc_lookup_listener(sap, laddr);
 
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
+        if (!rc)
+                rc = __llc_lookup_listener(sap, &null_addr);
 
-                if (rc->sk_type == SOCK_STREAM && rc->sk_state == TCP_LISTEN &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    (llc_mac_match(llc->laddr.mac, laddr->mac) ||
-                     llc_mac_null(llc->laddr.mac))) {
-                        sock_hold(rc);
-                        goto found;
-                }
-        }
-        rc = NULL;
-found:
-        read_unlock(&sap->sk_list.lock);
         return rc;
 }
 
@@ -647,15 +707,22 @@ static int llc_find_offset(int state, int ev_type)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function adds a socket to sk_list of a SAP.
+ *      This function adds a socket to the hash tables of a SAP.
  */
 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
 {
+        struct llc_sock *llc = llc_sk(sk);
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, llc->dev->ifindex);
+        struct hlist_nulls_head *laddr_hb = llc_sk_laddr_hash(sap, &llc->laddr);
+
         llc_sap_hold(sap);
-        write_lock_bh(&sap->sk_list.lock);
         llc_sk(sk)->sap = sap;
-        sk_add_node(sk, &sap->sk_list.list);
-        write_unlock_bh(&sap->sk_list.lock);
+
+        spin_lock_bh(&sap->sk_lock);
+        sap->sk_count++;
+        sk_nulls_add_node_rcu(sk, laddr_hb);
+        hlist_add_head(&llc->dev_hash_node, dev_hb);
+        spin_unlock_bh(&sap->sk_lock);
 }
 
 /**
@@ -663,14 +730,18 @@ void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function removes a connection from sk_list.list of a SAP if
+ *      This function removes a connection from the hash tables of a SAP if
  *      the connection was in this list.
  */
 void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 {
-        write_lock_bh(&sap->sk_list.lock);
-        sk_del_node_init(sk);
-        write_unlock_bh(&sap->sk_list.lock);
+        struct llc_sock *llc = llc_sk(sk);
+
+        spin_lock_bh(&sap->sk_lock);
+        sk_nulls_del_node_init_rcu(sk);
+        hlist_del(&llc->dev_hash_node);
+        sap->sk_count--;
+        spin_unlock_bh(&sap->sk_lock);
         llc_sap_put(sap);
 }
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ff4c0ab96a6..78167e81dfe 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -23,7 +23,7 @@
 #include <net/llc.h>
 
 LIST_HEAD(llc_sap_list);
-DEFINE_RWLOCK(llc_sap_list_lock);
+DEFINE_SPINLOCK(llc_sap_list_lock);
 
 /**
  *      llc_sap_alloc - allocates and initializes sap.
@@ -33,40 +33,19 @@ DEFINE_RWLOCK(llc_sap_list_lock);
 static struct llc_sap *llc_sap_alloc(void)
 {
         struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
+        int i;
 
         if (sap) {
                 /* sap->laddr.mac - leave as a null, it's filled by bind */
                 sap->state = LLC_SAP_STATE_ACTIVE;
-                rwlock_init(&sap->sk_list.lock);
+                spin_lock_init(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++)
+                        INIT_HLIST_NULLS_HEAD(&sap->sk_laddr_hash[i], i);
                 atomic_set(&sap->refcnt, 1);
         }
         return sap;
 }
 
-/**
- *      llc_add_sap - add sap to station list
- *      @sap: Address of the sap
- *
- *      Adds a sap to the LLC's station sap list.
- */
-static void llc_add_sap(struct llc_sap *sap)
-{
-        list_add_tail(&sap->node, &llc_sap_list);
-}
-
-/**
- *      llc_del_sap - del sap from station list
- *      @sap: Address of the sap
- *
- *      Removes a sap to the LLC's station sap list.
- */
-static void llc_del_sap(struct llc_sap *sap)
-{
-        write_lock_bh(&llc_sap_list_lock);
-        list_del(&sap->node);
-        write_unlock_bh(&llc_sap_list_lock);
-}
-
 static struct llc_sap *__llc_sap_find(unsigned char sap_value)
 {
         struct llc_sap* sap;
@@ -90,13 +69,13 @@ out:
  */
 struct llc_sap *llc_sap_find(unsigned char sap_value)
 {
-        struct llc_sap* sap;
+        struct llc_sap *sap;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         sap = __llc_sap_find(sap_value);
         if (sap)
                 llc_sap_hold(sap);
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
         return sap;
 }
 
@@ -117,7 +96,7 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
 {
         struct llc_sap *sap = NULL;
 
-        write_lock_bh(&llc_sap_list_lock);
+        spin_lock_bh(&llc_sap_list_lock);
         if (__llc_sap_find(lsap)) /* SAP already exists */
                 goto out;
         sap = llc_sap_alloc();
@@ -125,9 +104,9 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                 goto out;
         sap->laddr.lsap = lsap;
         sap->rcv_func   = func;
-        llc_add_sap(sap);
+        list_add_tail_rcu(&sap->node, &llc_sap_list);
 out:
-        write_unlock_bh(&llc_sap_list_lock);
+        spin_unlock_bh(&llc_sap_list_lock);
         return sap;
 }
 
@@ -142,8 +121,14 @@ out:
  */
 void llc_sap_close(struct llc_sap *sap)
 {
-        WARN_ON(!hlist_empty(&sap->sk_list.list));
-        llc_del_sap(sap);
+        WARN_ON(sap->sk_count);
+
+        spin_lock_bh(&llc_sap_list_lock);
+        list_del_rcu(&sap->node);
+        spin_unlock_bh(&llc_sap_list_lock);
+
+        synchronize_rcu();
+
         kfree(sap);
 }
 
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index 754f4fedc85..b38a1079a98 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -33,48 +33,19 @@
 int llc_mac_hdr_init(struct sk_buff *skb,
                      const unsigned char *sa, const unsigned char *da)
 {
-        int rc = 0;
+        int rc = -EINVAL;
 
         switch (skb->dev->type) {
-#ifdef CONFIG_TR
-        case ARPHRD_IEEE802_TR: {
-                struct net_device *dev = skb->dev;
-                struct trh_hdr *trh;
-
-                skb_push(skb, sizeof(*trh));
-                skb_reset_mac_header(skb);
-                trh = tr_hdr(skb);
-                trh->ac = AC;
-                trh->fc = LLC_FRAME;
-                if (sa)
-                        memcpy(trh->saddr, sa, dev->addr_len);
-                else
-                        memset(trh->saddr, 0, dev->addr_len);
-                if (da) {
-                        memcpy(trh->daddr, da, dev->addr_len);
-                        tr_source_route(skb, trh, dev);
-                        skb_reset_mac_header(skb);
-                }
-                break;
-        }
-#endif
+        case ARPHRD_IEEE802_TR:
         case ARPHRD_ETHER:
-        case ARPHRD_LOOPBACK: {
-                unsigned short len = skb->len;
-                struct ethhdr *eth;
-
-                skb_push(skb, sizeof(*eth));
-                skb_reset_mac_header(skb);
-                eth = eth_hdr(skb);
-                eth->h_proto = htons(len);
-                memcpy(eth->h_dest, da, ETH_ALEN);
-                memcpy(eth->h_source, sa, ETH_ALEN);
+        case ARPHRD_LOOPBACK:
+                rc = dev_hard_header(skb, skb->dev, ETH_P_802_2, da, sa,
+                                     skb->len);
+                if (rc > 0)
+                        rc = 0;
                 break;
-        }
         default:
-                printk(KERN_WARNING "device type not supported: %d\n",
-                       skb->dev->type);
-                rc = -EINVAL;
+                WARN(1, "device type not supported: %d\n", skb->dev->type);
         }
         return rc;
 }
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index be47ac427f6..7af1ff2d1f1 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -32,21 +32,23 @@ static void llc_ui_format_mac(struct seq_file *seq, u8 *addr)
 
 static struct sock *llc_get_sk_idx(loff_t pos)
 {
-        struct list_head *sap_entry;
         struct llc_sap *sap;
-        struct hlist_node *node;
         struct sock *sk = NULL;
-
-        list_for_each(sap_entry, &llc_sap_list) {
-                sap = list_entry(sap_entry, struct llc_sap, node);
-
-                read_lock_bh(&sap->sk_list.lock);
-                sk_for_each(sk, node, &sap->sk_list.list) {
-                        if (!pos)
-                                goto found;
-                        --pos;
+        int i;
+
+        list_for_each_entry_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++) {
+                        struct hlist_nulls_head *head = &sap->sk_laddr_hash[i];
+                        struct hlist_nulls_node *node;
+
+                        sk_nulls_for_each(sk, node, head) {
+                                if (!pos)
+                                        goto found; /* keep the lock */
+                                --pos;
+                        }
                 }
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
         sk = NULL;
 found:
@@ -57,10 +59,23 @@ static void *llc_seq_start(struct seq_file *seq, loff_t *pos)
 {
         loff_t l = *pos;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         return l ? llc_get_sk_idx(--l) : SEQ_START_TOKEN;
 }
 
+static struct sock *laddr_hash_next(struct llc_sap *sap, int bucket)
+{
+        struct hlist_nulls_node *node;
+        struct sock *sk = NULL;
+
+        while (++bucket < LLC_SK_LADDR_HASH_ENTRIES)
+                sk_nulls_for_each(sk, node, &sap->sk_laddr_hash[bucket])
+                        goto out;
+
+out:
+        return sk;
+}
+
 static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct sock* sk, *next;
@@ -73,25 +88,23 @@ static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 goto out;
         }
         sk = v;
-        next = sk_next(sk);
+        next = sk_nulls_next(sk);
         if (next) {
                 sk = next;
                 goto out;
         }
         llc = llc_sk(sk);
         sap = llc->sap;
-        read_unlock_bh(&sap->sk_list.lock);
-        sk = NULL;
-        for (;;) {
-                if (sap->node.next == &llc_sap_list)
-                        break;
-                sap = list_entry(sap->node.next, struct llc_sap, node);
-                read_lock_bh(&sap->sk_list.lock);
-                if (!hlist_empty(&sap->sk_list.list)) {
-                        sk = sk_head(&sap->sk_list.list);
-                        break;
-                }
-                read_unlock_bh(&sap->sk_list.lock);
+        sk = laddr_hash_next(sap, llc_sk_laddr_hashfn(sap, &llc->laddr));
+        if (sk)
+                goto out;
+        spin_unlock_bh(&sap->sk_lock);
+        list_for_each_entry_continue_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                sk = laddr_hash_next(sap, -1);
+                if (sk)
+                        break; /* keep the lock */
+                spin_unlock_bh(&sap->sk_lock);
         }
 out:
         return sk;
@@ -104,9 +117,9 @@ static void llc_seq_stop(struct seq_file *seq, void *v)
                 struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
 }
 
 static int llc_seq_socket_show(struct seq_file *seq, void *v)
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 008de1fc42c..ad6e6e1cf22 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -297,6 +297,17 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
         llc_sap_state_process(sap, skb);
 }
 
+static inline bool llc_dgram_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
 /**
  *      llc_lookup_dgram - Finds dgram socket for the local sap/mac
  *      @sap: SAP
@@ -309,25 +320,68 @@ static struct sock *llc_lookup_dgram(struct llc_sap *sap,
                                      const struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (rc->sk_type == SOCK_DGRAM &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock_bh();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_dgram_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_dgram_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        rcu_read_unlock_bh();
         return rc;
 }
 
+static inline bool llc_mcast_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sk_buff *skb,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc->dev == skb->dev;
+}
+
+static void llc_do_mcast(struct llc_sap *sap, struct sk_buff *skb,
+                         struct sock **stack, int count)
+{
+        struct sk_buff *skb1;
+        int i;
+
+        for (i = 0; i < count; i++) {
+                skb1 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb1) {
+                        sock_put(stack[i]);
+                        continue;
+                }
+
+                llc_sap_rcv(sap, skb1, stack[i]);
+                sock_put(stack[i]);
+        }
+}
+
 /**
  *      llc_sap_mcast - Deliver multicast PDU's to all matching datagram sockets.
  *      @sap: SAP
@@ -340,32 +394,31 @@ static void llc_sap_mcast(struct llc_sap *sap,
                           const struct llc_addr *laddr,
                           struct sk_buff *skb)
 {
-        struct sock *sk;
+        int i = 0, count = 256 / sizeof(struct sock *);
+        struct sock *sk, *stack[count];
         struct hlist_node *node;
+        struct llc_sock *llc;
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, skb->dev->ifindex);
 
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(sk, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(sk);
-                struct sk_buff *skb1;
+        spin_lock_bh(&sap->sk_lock);
+        hlist_for_each_entry(llc, node, dev_hb, dev_hash_node) {
 
-                if (sk->sk_type != SOCK_DGRAM)
-                        continue;
+                sk = &llc->sk;
 
-                if (llc->laddr.lsap != laddr->lsap)
+                if (!llc_mcast_match(sap, laddr, skb, sk))
                         continue;
 
-                if (llc->dev != skb->dev)
-                        continue;
-
-                skb1 = skb_clone(skb, GFP_ATOMIC);
-                if (!skb1)
-                        break;
-
                 sock_hold(sk);
-                llc_sap_rcv(sap, skb1, sk);
-                sock_put(sk);
+                if (i < count)
+                        stack[i++] = sk;
+                else {
+                        llc_do_mcast(sap, skb, stack, i);
+                        i = 0;
+                }
         }
-        read_unlock_bh(&sap->sk_list.lock);
+        spin_unlock_bh(&sap->sk_lock);
+
+        llc_do_mcast(sap, skb, stack, i);
 }