Merge ../scsi-rc-fixes-2.6

3 files changed, 104 insertions, 42 deletions

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2a7861661f14..7736b23c3f03 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -883,30 +883,32 @@ out:
 }
 EXPORT_SYMBOL(xfrm_policy_walk);
 
-/* Find policy to apply to this flow. */
-
+/*
+ * Find policy to apply to this flow.
+ *
+ * Returns 0 if policy found, else an -errno.
+ */
 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
                              u8 type, u16 family, int dir)
 {
         struct xfrm_selector *sel = &pol->selector;
-        int match;
+        int match, ret = -ESRCH;
 
         if (pol->family != family ||
             pol->type != type)
-                return 0;
+                return ret;
 
         match = xfrm_selector_match(sel, fl, family);
-        if (match) {
-                if (!security_xfrm_policy_lookup(pol, fl->secid, dir))
-                        return 1;
-        }
+        if (match)
+                ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
 
-        return 0;
+        return ret;
 }
 
 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
                                                      u16 family, u8 dir)
 {
+        int err;
         struct xfrm_policy *pol, *ret;
         xfrm_address_t *daddr, *saddr;
         struct hlist_node *entry;
@@ -922,7 +924,15 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         chain = policy_hash_direct(daddr, saddr, family, dir);
         ret = NULL;
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir)) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else {
                         ret = pol;
                         priority = ret->priority;
                         break;
@@ -930,36 +940,53 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         }
         chain = &xfrm_policy_inexact[dir];
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir) &&
-                    pol->priority < priority) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else if (pol->priority < priority) {
                         ret = pol;
                         break;
                 }
         }
         if (ret)
                 xfrm_pol_hold(ret);
+fail:
         read_unlock_bh(&xfrm_policy_lock);
 
         return ret;
 }
 
-static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
+static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp)
 {
         struct xfrm_policy *pol;
+        int err = 0;
 
 #ifdef CONFIG_XFRM_SUB_POLICY
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir);
-        if (pol)
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
+        if (pol || err)
                 goto end;
 #endif
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir);
-
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
 #ifdef CONFIG_XFRM_SUB_POLICY
 end:
 #endif
         if ((*objp = (void *) pol) != NULL)
                 *obj_refp = &pol->refcnt;
+        return err;
 }
 
 static inline int policy_to_flow_dir(int dir)
@@ -989,12 +1016,16 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
                                                 sk->sk_family);
                 int err = 0;
 
-                if (match)
-                  err = security_xfrm_policy_lookup(pol, fl->secid, policy_to_flow_dir(dir));
-
-                if (match && !err)
-                        xfrm_pol_hold(pol);
-                else
+                if (match) {
+                        err = security_xfrm_policy_lookup(pol, fl->secid,
+                                        policy_to_flow_dir(dir));
+                        if (!err)
+                                xfrm_pol_hold(pol);
+                        else if (err == -ESRCH)
+                                pol = NULL;
+                        else
+                                pol = ERR_PTR(err);
+                } else
                         pol = NULL;
         }
         read_unlock_bh(&xfrm_policy_lock);
@@ -1286,8 +1317,11 @@ restart:
         pol_dead = 0;
         xfrm_nr = 0;
 
-        if (sk && sk->sk_policy[1])
+        if (sk && sk->sk_policy[1]) {
                 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
+        }
 
         if (!policy) {
                 /* To accelerate a bit...  */
@@ -1297,6 +1331,8 @@ restart:
 
                 policy = flow_cache_lookup(fl, dst_orig->ops->family,
                                            dir, xfrm_policy_lookup);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
         }
 
         if (!policy)
@@ -1343,6 +1379,10 @@ restart:
                                                             fl, family,
                                                             XFRM_POLICY_OUT);
                         if (pols[1]) {
+                                if (IS_ERR(pols[1])) {
+                                        err = PTR_ERR(pols[1]);
+                                        goto error;
+                                }
                                 if (pols[1]->action == XFRM_POLICY_BLOCK) {
                                         err = -EPERM;
                                         goto error;
@@ -1574,13 +1614,19 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         }
 
         pol = NULL;
-        if (sk && sk->sk_policy[dir])
+        if (sk && sk->sk_policy[dir]) {
                 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                if (IS_ERR(pol))
+                        return 0;
+        }
 
         if (!pol)
                 pol = flow_cache_lookup(&fl, family, fl_dir,
                                         xfrm_policy_lookup);
 
+        if (IS_ERR(pol))
+                return 0;
+
         if (!pol) {
                 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
                         xfrm_secpath_reject(xerr_idx, skb, &fl);
@@ -1599,6 +1645,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                                                     &fl, family,
                                                     XFRM_POLICY_IN);
                 if (pols[1]) {
+                        if (IS_ERR(pols[1]))
+                                return 0;
                         pols[1]->curlft.use_time = (unsigned long)xtime.tv_sec;
                         npols ++;
                 }
@@ -1706,7 +1754,7 @@ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 
 static int stale_bundle(struct dst_entry *dst)
 {
-        return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
+        return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
 }
 
 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
@@ -1828,7 +1876,8 @@ EXPORT_SYMBOL(xfrm_init_pmtu);
  * still valid.
  */
 
-int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int strict)
+int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
+                struct flowi *fl, int family, int strict)
 {
         struct dst_entry *dst = &first->u.dst;
         struct xfrm_dst *last;
@@ -1845,7 +1894,7 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int str
 
                 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
                         return 0;
-                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm))
+                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm, pol))
                         return 0;
                 if (dst->xfrm->km.state != XFRM_STATE_VALID)
                         return 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 39b8bf3a9ded..899de9ed22a6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -505,6 +505,14 @@ __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
                                                   x->id.proto, family);
 }
 
+static void xfrm_hash_grow_check(int have_hash_collision)
+{
+        if (have_hash_collision &&
+            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
+            xfrm_state_num > xfrm_state_hmask)
+                schedule_work(&xfrm_hash_work);
+}
+
 struct xfrm_state *
 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
                 struct flowi *fl, struct xfrm_tmpl *tmpl,
@@ -598,6 +606,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
                         add_timer(&x->timer);
+                        xfrm_state_num++;
+                        xfrm_hash_grow_check(x->bydst.next != NULL);
                 } else {
                         x->km.state = XFRM_STATE_DEAD;
                         xfrm_state_put(x);
@@ -642,10 +652,7 @@ static void __xfrm_state_insert(struct xfrm_state *x)
 
         xfrm_state_num++;
 
-        if (x->bydst.next != NULL &&
-            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
-            xfrm_state_num > xfrm_state_hmask)
-                schedule_work(&xfrm_hash_work);
+        xfrm_hash_grow_check(x->bydst.next != NULL);
 }
 
 /* xfrm_state_lock is held */
@@ -753,6 +760,10 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                 h = xfrm_src_hash(daddr, saddr, family);
                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
                 wake_up(&km_waitq);
+
+                xfrm_state_num++;
+
+                xfrm_hash_grow_check(x->bydst.next != NULL);
         }
 
         return x;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d54b3a70d5df..c4cde57d9216 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -323,7 +323,7 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
         x->props.replay_window = p->replay_window;
         x->props.reqid = p->reqid;
         x->props.family = p->family;
-        x->props.saddr = p->saddr;
+        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
         x->props.flags = p->flags;
 }
 
@@ -545,7 +545,7 @@ static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
         memcpy(&p->lft, &x->lft, sizeof(p->lft));
         memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
         memcpy(&p->stats, &x->stats, sizeof(p->stats));
-        p->saddr = x->props.saddr;
+        memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
         p->mode = x->props.mode;
         p->replay_window = x->props.replay_window;
         p->reqid = x->props.reqid;
@@ -1927,6 +1927,9 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -1992,15 +1995,6 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
         xp->type = XFRM_POLICY_TYPE_MAIN;
         copy_templates(xp, ut, nr);
 
-        if (!xp->security) {
-                int err = security_xfrm_sock_policy_alloc(xp, sk);
-                if (err) {
-                        kfree(xp);
-                        *dir = err;
-                        return NULL;
-                }
-        }
-
         *dir = p->dir;
 
         return xp;
@@ -2043,6 +2037,9 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -2069,6 +2066,9 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
                 len += RTA_SPACE(headlen);
                 headlen = sizeof(*id);
         }
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         len += NLMSG_SPACE(headlen);
 
         skb = alloc_skb(len, GFP_ATOMIC);
@@ -2115,10 +2115,12 @@ static int xfrm_notify_policy_flush(struct km_event *c)
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
         unsigned char *b;
+        int len = 0;
 #ifdef CONFIG_XFRM_SUB_POLICY
         struct xfrm_userpolicy_type upt;
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
-        int len = NLMSG_LENGTH(0);
+        len += NLMSG_LENGTH(0);
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)