1 files changed, 20 insertions, 14 deletions

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index a20fb0bd1ef..cd1e8e0970f 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -319,7 +319,8 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         const struct nf_conntrack_expect_policy *p;
         unsigned int h = nf_ct_expect_dst_hash(&exp->tuple);
 
-        atomic_inc(&exp->use);
+        /* two references : one for hash insert, one for the timer */
+        atomic_add(2, &exp->use);
 
         if (master_help) {
                 hlist_add_head(&exp->lnode, &master_help->expectations);
@@ -333,12 +334,14 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
                     (unsigned long)exp);
         if (master_help) {
-                p = &master_help->helper->expect_policy[exp->class];
+                p = &rcu_dereference_protected(
+                                master_help->helper,
+                                lockdep_is_held(&nf_conntrack_lock)
+                                )->expect_policy[exp->class];
                 exp->timeout.expires = jiffies + p->timeout * HZ;
         }
         add_timer(&exp->timeout);
 
-        atomic_inc(&exp->use);
         NF_CT_STAT_INC(net, expect_create);
 }
 
@@ -369,7 +372,10 @@ static inline int refresh_timer(struct nf_conntrack_expect *i)
         if (!del_timer(&i->timeout))
                 return 0;
 
-        p = &master_help->helper->expect_policy[i->class];
+        p = &rcu_dereference_protected(
+                master_help->helper,
+                lockdep_is_held(&nf_conntrack_lock)
+                )->expect_policy[i->class];
         i->timeout.expires = jiffies + p->timeout * HZ;
         add_timer(&i->timeout);
         return 1;
@@ -407,7 +413,10 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         }
         /* Will be over limit? */
         if (master_help) {
-                p = &master_help->helper->expect_policy[expect->class];
+                p = &rcu_dereference_protected(
+                        master_help->helper,
+                        lockdep_is_held(&nf_conntrack_lock)
+                        )->expect_policy[expect->class];
                 if (p->max_expected &&
                     master_help->expecting[expect->class] >= p->max_expected) {
                         evict_oldest_expect(master, expect);
@@ -478,7 +487,7 @@ static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
         struct hlist_node *n;
 
         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
-                n = rcu_dereference(net->ct.expect_hash[st->bucket].first);
+                n = rcu_dereference(hlist_first_rcu(&net->ct.expect_hash[st->bucket]));
                 if (n)
                         return n;
         }
@@ -491,11 +500,11 @@ static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
         struct net *net = seq_file_net(seq);
         struct ct_expect_iter_state *st = seq->private;
 
-        head = rcu_dereference(head->next);
+        head = rcu_dereference(hlist_next_rcu(head));
         while (head == NULL) {
                 if (++st->bucket >= nf_ct_expect_hsize)
                         return NULL;
-                head = rcu_dereference(net->ct.expect_hash[st->bucket].first);
+                head = rcu_dereference(hlist_first_rcu(&net->ct.expect_hash[st->bucket]));
         }
         return head;
 }
@@ -630,8 +639,7 @@ int nf_conntrack_expect_init(struct net *net)
         }
 
         net->ct.expect_count = 0;
-        net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize,
-                                                  &net->ct.expect_vmalloc, 0);
+        net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize, 0);
         if (net->ct.expect_hash == NULL)
                 goto err1;
 
@@ -653,8 +661,7 @@ err3:
         if (net_eq(net, &init_net))
                 kmem_cache_destroy(nf_ct_expect_cachep);
 err2:
-        nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
-                             nf_ct_expect_hsize);
+        nf_ct_free_hashtable(net->ct.expect_hash, nf_ct_expect_hsize);
 err1:
         return err;
 }
@@ -666,6 +673,5 @@ void nf_conntrack_expect_fini(struct net *net)
                 rcu_barrier(); /* Wait for call_rcu() before destroy */
                 kmem_cache_destroy(nf_ct_expect_cachep);
         }
-        nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
-                             nf_ct_expect_hsize);
+        nf_ct_free_hashtable(net->ct.expect_hash, nf_ct_expect_hsize);
 }