4 files changed, 94 insertions, 63 deletions

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 25b8dbf6cfd7..b57bc9467dbe 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -979,7 +979,7 @@ static void alb_swap_mac_addr(struct bonding *bond, struct slave *slave1, struct
 /*
  * Send learning packets after MAC address swap.
  *
- * Called with RTNL and bond->lock held for read.
+ * Called with RTNL and no other locks
  */
 static void alb_fasten_mac_swap(struct bonding *bond, struct slave *slave1,
                                 struct slave *slave2)
@@ -987,6 +987,8 @@ static void alb_fasten_mac_swap(struct bonding *bond, struct slave *slave1,
         int slaves_state_differ = (SLAVE_IS_OK(slave1) != SLAVE_IS_OK(slave2));
         struct slave *disabled_slave = NULL;
 
+        ASSERT_RTNL();
+
         /* fasten the change in the switch */
         if (SLAVE_IS_OK(slave1)) {
                 alb_send_learning_packets(slave1, slave1->dev->dev_addr);
@@ -1031,7 +1033,7 @@ static void alb_fasten_mac_swap(struct bonding *bond, struct slave *slave1,
  * a slave that has @slave's permanet address as its current address.
  * We'll make sure that that slave no longer uses @slave's permanent address.
  *
- * Caller must hold bond lock
+ * Caller must hold RTNL and no other locks
  */
 static void alb_change_hw_addr_on_detach(struct bonding *bond, struct slave *slave)
 {
@@ -1542,7 +1544,12 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
         return 0;
 }
 
-/* Caller must hold bond lock for write */
+/*
+ * Remove slave from tlb and rlb hash tables, and fix up MAC addresses
+ * if necessary.
+ *
+ * Caller must hold RTNL and no other locks
+ */
 void bond_alb_deinit_slave(struct bonding *bond, struct slave *slave)
 {
         if (bond->slave_cnt > 1) {
@@ -1601,9 +1608,6 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
         struct slave *swap_slave;
         int i;
 
-        if (new_slave)
-                ASSERT_RTNL();
-
         if (bond->curr_active_slave == new_slave) {
                 return;
         }
@@ -1649,6 +1653,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
 
+        ASSERT_RTNL();
+
         /* curr_active_slave must be set before calling alb_swap_mac_addr */
         if (swap_slave) {
                 /* swap mac address */
@@ -1659,12 +1665,11 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
                                        bond->alb_info.rlb_enabled);
         }
 
-        read_lock(&bond->lock);
-
         if (swap_slave) {
                 alb_fasten_mac_swap(bond, swap_slave, new_slave);
+                read_lock(&bond->lock);
         } else {
-                /* fasten bond mac on new current slave */
+                read_lock(&bond->lock);
                 alb_send_learning_packets(new_slave, bond->dev->dev_addr);
         }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b0b26036266b..49a198206e3d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1746,7 +1746,9 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                  * has been cleared (if our_slave == old_current),
                  * but before a new active slave is selected.
                  */
+                write_unlock_bh(&bond->lock);
                 bond_alb_deinit_slave(bond, slave);
+                write_lock_bh(&bond->lock);
         }
 
         if (oldcurrent == slave) {
@@ -1905,6 +1907,12 @@ static int bond_release_all(struct net_device *bond_dev)
                 slave_dev = slave->dev;
                 bond_detach_slave(bond, slave);
 
+                /* now that the slave is detached, unlock and perform
+                 * all the undo steps that should not be called from
+                 * within a lock.
+                 */
+                write_unlock_bh(&bond->lock);
+
                 if ((bond->params.mode == BOND_MODE_TLB) ||
                     (bond->params.mode == BOND_MODE_ALB)) {
                         /* must be called only after the slave
@@ -1915,12 +1923,6 @@ static int bond_release_all(struct net_device *bond_dev)
 
                 bond_compute_features(bond);
 
-                /* now that the slave is detached, unlock and perform
-                 * all the undo steps that should not be called from
-                 * within a lock.
-                 */
-                write_unlock_bh(&bond->lock);
-
                 bond_destroy_slave_symlinks(bond_dev, slave_dev);
                 bond_del_vlans_from_slave(bond, slave_dev);
 
@@ -2384,7 +2386,9 @@ void bond_mii_monitor(struct work_struct *work)
                 rtnl_lock();
                 read_lock(&bond->lock);
                 __bond_mii_monitor(bond, 1);
-                rtnl_unlock();
+                read_unlock(&bond->lock);
+                rtnl_unlock();  /* might sleep, hold no other locks */
+                read_lock(&bond->lock);
         }
 
         delay = ((bond->params.miimon * HZ) / 1000) ? : 1;
@@ -3399,9 +3403,7 @@ static int bond_master_netdev_event(unsigned long event, struct net_device *bond
         case NETDEV_CHANGENAME:
                 return bond_event_changename(event_bond);
         case NETDEV_UNREGISTER:
-                /*
-                 * TODO: remove a bond from the list?
-                 */
+                bond_release_all(event_bond->dev);
                 break;
         default:
                 break;
@@ -4540,18 +4542,27 @@ static void bond_free_all(void)
 
 /*
  * Convert string input module parms.  Accept either the
- * number of the mode or its string name.
+ * number of the mode or its string name.  A bit complicated because
+ * some mode names are substrings of other names, and calls from sysfs
+ * may have whitespace in the name (trailing newlines, for example).
  */
-int bond_parse_parm(char *mode_arg, struct bond_parm_tbl *tbl)
+int bond_parse_parm(const char *buf, struct bond_parm_tbl *tbl)
 {
-        int i;
+        int mode = -1, i, rv;
+        char modestr[BOND_MAX_MODENAME_LEN + 1] = { 0, };
+
+        rv = sscanf(buf, "%d", &mode);
+        if (!rv) {
+                rv = sscanf(buf, "%20s", modestr);
+                if (!rv)
+                        return -1;
+        }
 
         for (i = 0; tbl[i].modename; i++) {
-                if ((isdigit(*mode_arg) &&
-                     tbl[i].mode == simple_strtol(mode_arg, NULL, 0)) ||
-                    (strcmp(mode_arg, tbl[i].modename) == 0)) {
+                if (mode == tbl[i].mode)
+                        return tbl[i].mode;
+                if (strcmp(modestr, tbl[i].modename) == 0)
                         return tbl[i].mode;
-                }
         }
 
         return -1;
@@ -4865,9 +4876,22 @@ static struct lock_class_key bonding_netdev_xmit_lock_key;
 int bond_create(char *name, struct bond_params *params, struct bonding **newbond)
 {
         struct net_device *bond_dev;
+        struct bonding *bond, *nxt;
         int res;
 
         rtnl_lock();
+        down_write(&bonding_rwsem);
+
+        /* Check to see if the bond already exists. */
+        list_for_each_entry_safe(bond, nxt, &bond_dev_list, bond_list)
+                if (strnicmp(bond->dev->name, name, IFNAMSIZ) == 0) {
+                        printk(KERN_ERR DRV_NAME
+                               ": cannot add bond %s; it already exists\n",
+                               name);
+                        res = -EPERM;
+                        goto out_rtnl;
+                }
+
         bond_dev = alloc_netdev(sizeof(struct bonding), name ? name : "",
                                 ether_setup);
         if (!bond_dev) {
@@ -4906,10 +4930,12 @@ int bond_create(char *name, struct bond_params *params, struct bonding **newbond
 
         netif_carrier_off(bond_dev);
 
+        up_write(&bonding_rwsem);
         rtnl_unlock(); /* allows sysfs registration of net device */
         res = bond_create_sysfs_entry(bond_dev->priv);
         if (res < 0) {
                 rtnl_lock();
+                down_write(&bonding_rwsem);
                 goto out_bond;
         }
 
@@ -4920,6 +4946,7 @@ out_bond:
 out_netdev:
         free_netdev(bond_dev);
 out_rtnl:
+        up_write(&bonding_rwsem);
         rtnl_unlock();
         return res;
 }
@@ -4940,6 +4967,9 @@ static int __init bonding_init(void)
 #ifdef CONFIG_PROC_FS
         bond_create_proc_dir();
 #endif
+
+        init_rwsem(&bonding_rwsem);
+
         for (i = 0; i < max_bonds; i++) {
                 res = bond_create(NULL, &bonding_defaults, NULL);
                 if (res)
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 11b76b352415..90a1f31e8e63 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -109,11 +109,10 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
 {
         char command[IFNAMSIZ + 1] = {0, };
         char *ifname;
-        int res = count;
+        int rv, res = count;
         struct bonding *bond;
         struct bonding *nxt;
 
-        down_write(&(bonding_rwsem));
         sscanf(buffer, "%16s", command); /* IFNAMSIZ*/
         ifname = command + 1;
         if ((strlen(command) <= 1) ||
@@ -121,39 +120,28 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
                 goto err_no_cmd;
 
         if (command[0] == '+') {
-
-                /* Check to see if the bond already exists. */
-                list_for_each_entry_safe(bond, nxt, &bond_dev_list, bond_list)
-                        if (strnicmp(bond->dev->name, ifname, IFNAMSIZ) == 0) {
-                                printk(KERN_ERR DRV_NAME
-                                        ": cannot add bond %s; it already exists\n",
-                                        ifname);
-                                res = -EPERM;
-                                goto out;
-                        }
-
                 printk(KERN_INFO DRV_NAME
                         ": %s is being created...\n", ifname);
-                if (bond_create(ifname, &bonding_defaults, &bond)) {
-                        printk(KERN_INFO DRV_NAME
-                        ": %s interface already exists. Bond creation failed.\n",
-                        ifname);
-                        res = -EPERM;
+                rv = bond_create(ifname, &bonding_defaults, &bond);
+                if (rv) {
+                        printk(KERN_INFO DRV_NAME ": Bond creation failed.\n");
+                        res = rv;
                 }
                 goto out;
         }
 
         if (command[0] == '-') {
+                rtnl_lock();
+                down_write(&bonding_rwsem);
+
                 list_for_each_entry_safe(bond, nxt, &bond_dev_list, bond_list)
                         if (strnicmp(bond->dev->name, ifname, IFNAMSIZ) == 0) {
-                                rtnl_lock();
                                 /* check the ref count on the bond's kobject.
                                  * If it's > expected, then there's a file open,
                                  * and we have to fail.
                                  */
                                 if (atomic_read(&bond->dev->dev.kobj.kref.refcount)
                                                         > expected_refcount){
-                                        rtnl_unlock();
                                         printk(KERN_INFO DRV_NAME
                                                 ": Unable remove bond %s due to open references.\n",
                                                 ifname);
@@ -164,6 +152,7 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
                                         ": %s is being deleted...\n",
                                         bond->dev->name);
                                 bond_destroy(bond);
+                                up_write(&bonding_rwsem);
                                 rtnl_unlock();
                                 goto out;
                         }
@@ -171,6 +160,8 @@ static ssize_t bonding_store_bonds(struct class *cls, const char *buffer, size_t
                 printk(KERN_ERR DRV_NAME
                         ": unable to delete non-existent bond %s\n", ifname);
                 res = -ENODEV;
+                up_write(&bonding_rwsem);
+                rtnl_unlock();
                 goto out;
         }
 
@@ -183,7 +174,6 @@ err_no_cmd:
          * get called forever, which is bad.
          */
 out:
-        up_write(&(bonding_rwsem));
         return res;
 }
 /* class attribute for bond_masters file.  This ends up in /sys/class/net */
@@ -271,6 +261,9 @@ static ssize_t bonding_store_slaves(struct device *d,
 
         /* Note:  We can't hold bond->lock here, as bond_create grabs it. */
 
+        rtnl_lock();
+        down_write(&(bonding_rwsem));
+
         sscanf(buffer, "%16s", command); /* IFNAMSIZ*/
         ifname = command + 1;
         if ((strlen(command) <= 1) ||
@@ -336,12 +329,10 @@ static ssize_t bonding_store_slaves(struct device *d,
                                 dev->mtu = bond->dev->mtu;
                         }
                 }
-                rtnl_lock();
                 res = bond_enslave(bond->dev, dev);
                 bond_for_each_slave(bond, slave, i)
                         if (strnicmp(slave->dev->name, ifname, IFNAMSIZ) == 0)
                                 slave->original_mtu = original_mtu;
-                rtnl_unlock();
                 if (res) {
                         ret = res;
                 }
@@ -359,12 +350,10 @@ static ssize_t bonding_store_slaves(struct device *d,
                 if (dev) {
                         printk(KERN_INFO DRV_NAME ": %s: Removing slave %s\n",
                                 bond->dev->name, dev->name);
-                        rtnl_lock();
                         if (bond->setup_by_slave)
                                 res = bond_release_and_destroy(bond->dev, dev);
                         else
                                 res = bond_release(bond->dev, dev);
-                        rtnl_unlock();
                         if (res) {
                                 ret = res;
                                 goto out;
@@ -389,6 +378,8 @@ err_no_cmd:
         ret = -EPERM;
 
 out:
+        up_write(&(bonding_rwsem));
+        rtnl_unlock();
         return ret;
 }
 
@@ -423,7 +414,7 @@ static ssize_t bonding_store_mode(struct device *d,
                 goto out;
         }
 
-        new_value = bond_parse_parm((char *)buf, bond_mode_tbl);
+        new_value = bond_parse_parm(buf, bond_mode_tbl);
         if (new_value < 0)  {
                 printk(KERN_ERR DRV_NAME
                        ": %s: Ignoring invalid mode value %.*s.\n",
@@ -478,7 +469,7 @@ static ssize_t bonding_store_xmit_hash(struct device *d,
                 goto out;
         }
 
-        new_value = bond_parse_parm((char *)buf, xmit_hashtype_tbl);
+        new_value = bond_parse_parm(buf, xmit_hashtype_tbl);
         if (new_value < 0)  {
                 printk(KERN_ERR DRV_NAME
                        ": %s: Ignoring invalid xmit hash policy value %.*s.\n",
@@ -518,7 +509,7 @@ static ssize_t bonding_store_arp_validate(struct device *d,
         int new_value;
         struct bonding *bond = to_bond(d);
 
-        new_value = bond_parse_parm((char *)buf, arp_validate_tbl);
+        new_value = bond_parse_parm(buf, arp_validate_tbl);
         if (new_value < 0) {
                 printk(KERN_ERR DRV_NAME
                        ": %s: Ignoring invalid arp_validate value %s\n",
@@ -941,7 +932,7 @@ static ssize_t bonding_store_lacp(struct device *d,
                 goto out;
         }
 
-        new_value = bond_parse_parm((char *)buf, bond_lacp_tbl);
+        new_value = bond_parse_parm(buf, bond_lacp_tbl);
 
         if ((new_value == 1) || (new_value == 0)) {
                 bond->params.lacp_fast = new_value;
@@ -1075,7 +1066,10 @@ static ssize_t bonding_store_primary(struct device *d,
         struct slave *slave;
         struct bonding *bond = to_bond(d);
 
-        write_lock_bh(&bond->lock);
+        rtnl_lock();
+        read_lock(&bond->lock);
+        write_lock_bh(&bond->curr_slave_lock);
+
         if (!USES_PRIMARY(bond->params.mode)) {
                 printk(KERN_INFO DRV_NAME
                        ": %s: Unable to set primary slave; %s is in mode %d\n",
@@ -1109,8 +1103,8 @@ static ssize_t bonding_store_primary(struct device *d,
                 }
         }
 out:
-        write_unlock_bh(&bond->lock);
-
+        write_unlock_bh(&bond->curr_slave_lock);
+        read_unlock(&bond->lock);
         rtnl_unlock();
 
         return count;
@@ -1190,7 +1184,8 @@ static ssize_t bonding_store_active_slave(struct device *d,
         struct bonding *bond = to_bond(d);
 
         rtnl_lock();
-        write_lock_bh(&bond->lock);
+        read_lock(&bond->lock);
+        write_lock_bh(&bond->curr_slave_lock);
 
         if (!USES_PRIMARY(bond->params.mode)) {
                 printk(KERN_INFO DRV_NAME
@@ -1247,7 +1242,8 @@ static ssize_t bonding_store_active_slave(struct device *d,
                 }
         }
 out:
-        write_unlock_bh(&bond->lock);
+        write_unlock_bh(&bond->curr_slave_lock);
+        read_unlock(&bond->lock);
         rtnl_unlock();
 
         return count;
@@ -1418,8 +1414,6 @@ int bond_create_sysfs(void)
         int ret = 0;
         struct bonding *firstbond;
 
-        init_rwsem(&bonding_rwsem);
-
         /* get the netdev class pointer */
         firstbond = container_of(bond_dev_list.next, struct bonding, bond_list);
         if (!firstbond)
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index e1e4734e23ce..6d83be49899a 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -141,6 +141,8 @@ struct bond_parm_tbl {
         int mode;
 };
 
+#define BOND_MAX_MODENAME_LEN 20
+
 struct vlan_entry {
         struct list_head vlan_list;
         __be32 vlan_ip;
@@ -314,7 +316,7 @@ void bond_mii_monitor(struct work_struct *);
 void bond_loadbalance_arp_mon(struct work_struct *);
 void bond_activebackup_arp_mon(struct work_struct *);
 void bond_set_mode_ops(struct bonding *bond, int mode);
-int bond_parse_parm(char *mode_arg, struct bond_parm_tbl *tbl);
+int bond_parse_parm(const char *mode_arg, struct bond_parm_tbl *tbl);
 void bond_select_active_slave(struct bonding *bond);
 void bond_change_active_slave(struct bonding *bond, struct slave *new_active);
 void bond_register_arp(struct bonding *);