Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (51 commits)
  [IPV6]: Fix again the fl6_sock_lookup() fixed locking
  [NETFILTER]: nf_conntrack_tcp: fix connection reopening fix
  [IPV6]: Fix race in ipv6_flowlabel_opt() when inserting two labels
  [IPV6]: Lost locking in fl6_sock_lookup
  [IPV6]: Lost locking when inserting a flowlabel in ipv6_fl_list
  [NETFILTER]: xt_sctp: fix mistake to pass a pointer where array is required
  [NET]: Fix OOPS due to missing check in dev_parse_header().
  [TCP]: Remove lost_retrans zero seqno special cases
  [NET]: fix carrier-on bug?
  [NET]: Fix uninitialised variable in ip_frag_reasm()
  [IPSEC]: Rename mode to outer_mode and add inner_mode
  [IPSEC]: Disallow combinations of RO and AH/ESP/IPCOMP
  [IPSEC]: Use the top IPv4 route's peer instead of the bottom
  [IPSEC]: Store afinfo pointer in xfrm_mode
  [IPSEC]: Add missing BEET checks
  [IPSEC]: Move type and mode map into xfrm_state.c
  [IPSEC]: Fix length check in xfrm_parse_spi
  [IPSEC]: Move ip_summed zapping out of xfrm6_rcv_spi
  [IPSEC]: Get nexthdr from caller in xfrm6_rcv_spi
  [IPSEC]: Move tunnel parsing for IPv4 out of xfrm4_input
  ...

1 files changed, 88 insertions, 1 deletions

diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 484cf512858f..e15e04fc6661 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -136,7 +136,9 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f,
                 *work -= f->qsize;
         atomic_sub(f->qsize, &f->mem);
 
-        f->destructor(q);
+        if (f->destructor)
+                f->destructor(q);
+        kfree(q);
 
 }
 EXPORT_SYMBOL(inet_frag_destroy);
@@ -172,3 +174,88 @@ int inet_frag_evictor(struct inet_frags *f)
         return evicted;
 }
 EXPORT_SYMBOL(inet_frag_evictor);
+
+static struct inet_frag_queue *inet_frag_intern(struct inet_frag_queue *qp_in,
+                struct inet_frags *f, unsigned int hash, void *arg)
+{
+        struct inet_frag_queue *qp;
+#ifdef CONFIG_SMP
+        struct hlist_node *n;
+#endif
+
+        write_lock(&f->lock);
+#ifdef CONFIG_SMP
+        /* With SMP race we have to recheck hash table, because
+         * such entry could be created on other cpu, while we
+         * promoted read lock to write lock.
+         */
+        hlist_for_each_entry(qp, n, &f->hash[hash], list) {
+                if (f->match(qp, arg)) {
+                        atomic_inc(&qp->refcnt);
+                        write_unlock(&f->lock);
+                        qp_in->last_in |= COMPLETE;
+                        inet_frag_put(qp_in, f);
+                        return qp;
+                }
+        }
+#endif
+        qp = qp_in;
+        if (!mod_timer(&qp->timer, jiffies + f->ctl->timeout))
+                atomic_inc(&qp->refcnt);
+
+        atomic_inc(&qp->refcnt);
+        hlist_add_head(&qp->list, &f->hash[hash]);
+        list_add_tail(&qp->lru_list, &f->lru_list);
+        f->nqueues++;
+        write_unlock(&f->lock);
+        return qp;
+}
+
+static struct inet_frag_queue *inet_frag_alloc(struct inet_frags *f, void *arg)
+{
+        struct inet_frag_queue *q;
+
+        q = kzalloc(f->qsize, GFP_ATOMIC);
+        if (q == NULL)
+                return NULL;
+
+        f->constructor(q, arg);
+        atomic_add(f->qsize, &f->mem);
+        setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
+        spin_lock_init(&q->lock);
+        atomic_set(&q->refcnt, 1);
+
+        return q;
+}
+
+static struct inet_frag_queue *inet_frag_create(struct inet_frags *f,
+                void *arg, unsigned int hash)
+{
+        struct inet_frag_queue *q;
+
+        q = inet_frag_alloc(f, arg);
+        if (q == NULL)
+                return NULL;
+
+        return inet_frag_intern(q, f, hash, arg);
+}
+
+struct inet_frag_queue *inet_frag_find(struct inet_frags *f, void *key,
+                unsigned int hash)
+{
+        struct inet_frag_queue *q;
+        struct hlist_node *n;
+
+        read_lock(&f->lock);
+        hlist_for_each_entry(q, n, &f->hash[hash], list) {
+                if (f->match(q, key)) {
+                        atomic_inc(&q->refcnt);
+                        read_unlock(&f->lock);
+                        return q;
+                }
+        }
+        read_unlock(&f->lock);
+
+        return inet_frag_create(f, key, hash);
+}
+EXPORT_SYMBOL(inet_frag_find);