10 files changed, 32 insertions, 30 deletions

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index ec0e36893b01..b425748f02d7 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -241,7 +241,7 @@ static int arp_constructor(struct neighbour *neigh)
         neigh->type = inet_addr_type(addr);
 
         rcu_read_lock();
-        in_dev = rcu_dereference(__in_dev_get(dev));
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev == NULL) {
                 rcu_read_unlock();
                 return -EINVAL;
@@ -989,8 +989,8 @@ static int arp_req_set(struct arpreq *r, struct net_device * dev)
                         ipv4_devconf.proxy_arp = 1;
                         return 0;
                 }
-                if (__in_dev_get(dev)) {
-                        __in_dev_get(dev)->cnf.proxy_arp = 1;
+                if (__in_dev_get_rtnl(dev)) {
+                        __in_dev_get_rtnl(dev)->cnf.proxy_arp = 1;
                         return 0;
                 }
                 return -ENXIO;
@@ -1095,8 +1095,8 @@ static int arp_req_delete(struct arpreq *r, struct net_device * dev)
                                 ipv4_devconf.proxy_arp = 0;
                                 return 0;
                         }
-                        if (__in_dev_get(dev)) {
-                                __in_dev_get(dev)->cnf.proxy_arp = 0;
+                        if (__in_dev_get_rtnl(dev)) {
+                                __in_dev_get_rtnl(dev)->cnf.proxy_arp = 0;
                                 return 0;
                         }
                         return -ENXIO;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ba2895ae8151..74f2207e131a 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -351,7 +351,7 @@ static int inet_insert_ifa(struct in_ifaddr *ifa)
 
 static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         ASSERT_RTNL();
 
@@ -449,7 +449,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                 goto out;
 
         rc = -ENOBUFS;
-        if ((in_dev = __in_dev_get(dev)) == NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
                 in_dev = inetdev_init(dev);
                 if (!in_dev)
                         goto out;
@@ -584,7 +584,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -748,7 +748,7 @@ rarok:
 
 static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
         struct in_ifaddr *ifa;
         struct ifreq ifr;
         int done = 0;
@@ -791,7 +791,7 @@ u32 inet_select_addr(const struct net_device *dev, u32 dst, int scope)
         struct in_device *in_dev;
 
         rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto no_in_dev;
 
@@ -818,7 +818,7 @@ no_in_dev:
         read_lock(&dev_base_lock);
         rcu_read_lock();
         for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev)) == NULL)
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
                         continue;
 
                 for_primary_ifa(in_dev) {
@@ -887,7 +887,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
 
         if (dev) {
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)))
+                if ((in_dev = __in_dev_get_rcu(dev)))
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                 rcu_read_unlock();
 
@@ -897,7 +897,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
         read_lock(&dev_base_lock);
         rcu_read_lock();
         for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev))) {
+                if ((in_dev = __in_dev_get_rcu(dev))) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
@@ -957,7 +957,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                          void *ptr)
 {
         struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         ASSERT_RTNL();
 
@@ -1078,7 +1078,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                 if (idx > s_idx)
                         s_ip_idx = 0;
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) == NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
                         rcu_read_unlock();
                         continue;
                 }
@@ -1149,7 +1149,7 @@ void inet_forward_change(void)
         for (dev = dev_base; dev; dev = dev->next) {
                 struct in_device *in_dev;
                 rcu_read_lock();
-                in_dev = __in_dev_get(dev);
+                in_dev = __in_dev_get_rcu(dev);
                 if (in_dev)
                         in_dev->cnf.forwarding = on;
                 rcu_read_unlock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e1379f71269..e61bc7177eb1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -173,7 +173,7 @@ int fib_validate_source(u32 src, u32 dst, u8 tos, int oif,
 
         no_addr = rpf = 0;
         rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
@@ -607,7 +607,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         if (event == NETDEV_UNREGISTER) {
                 fib_disable_ip(dev, 2);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d41219e8037c..186f20c4a45e 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1087,7 +1087,7 @@ fib_convert_rtentry(int cmd, struct nlmsghdr *nl, struct rtmsg *rtm,
                 rta->rta_oif = &dev->ifindex;
                 if (colon) {
                         struct in_ifaddr *ifa;
-                        struct in_device *in_dev = __in_dev_get(dev);
+                        struct in_device *in_dev = __in_dev_get_rtnl(dev);
                         if (!in_dev)
                                 return -ENODEV;
                         *colon = ':';
@@ -1268,7 +1268,7 @@ int fib_sync_up(struct net_device *dev)
                         }
                         if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
                                 continue;
-                        if (nh->nh_dev != dev || __in_dev_get(dev) == NULL)
+                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
                                 continue;
                         alive++;
                         spin_lock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 70c44e4c3ceb..8b6d3939e1e6 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1323,7 +1323,7 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
         }
         if (dev) {
                 imr->imr_ifindex = dev->ifindex;
-                idev = __in_dev_get(dev);
+                idev = __in_dev_get_rtnl(dev);
         }
         return idev;
 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f0d5740d7e22..896ce3f8f53a 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1104,10 +1104,10 @@ static int ipgre_open(struct net_device *dev)
                         return -EADDRNOTAVAIL;
                 dev = rt->u.dst.dev;
                 ip_rt_put(rt);
-                if (__in_dev_get(dev) == NULL)
+                if (__in_dev_get_rtnl(dev) == NULL)
                         return -EADDRNOTAVAIL;
                 t->mlink = dev->ifindex;
-                ip_mc_inc_group(__in_dev_get(dev), t->parms.iph.daddr);
+                ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
         }
         return 0;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9dbf5909f3a6..302b7eb507c9 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -149,7 +149,7 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
                 if (err == 0 && (dev = __dev_get_by_name(p.name)) != NULL) {
                         dev->flags |= IFF_MULTICAST;
 
-                        in_dev = __in_dev_get(dev);
+                        in_dev = __in_dev_get_rtnl(dev);
                         if (in_dev == NULL && (in_dev = inetdev_init(dev)) == NULL)
                                 goto failure;
                         in_dev->cnf.rp_filter = 0;
@@ -278,7 +278,7 @@ static int vif_delete(int vifi)
 
         dev_set_allmulti(dev, -1);
 
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                 in_dev->cnf.mc_forwarding--;
                 ip_rt_multicast_event(in_dev);
         }
@@ -421,7 +421,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                 return -EINVAL;
         }
 
-        if ((in_dev = __in_dev_get(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
                 return -EADDRNOTAVAIL;
         in_dev->cnf.mc_forwarding++;
         dev_set_allmulti(dev, +1);
diff --git a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
index 577bac22dcc6..186646eb249f 100644
--- a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
+++ b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
@@ -58,7 +58,7 @@ static int help(struct sk_buff **pskb,
                 goto out;
 
         rcu_read_lock();
-        in_dev = __in_dev_get(rt->u.dst.dev);
+        in_dev = __in_dev_get_rcu(rt->u.dst.dev);
         if (in_dev != NULL) {
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_broadcast == iph->daddr) {
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 715cb613405c..5245bfd33d52 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -93,7 +93,7 @@ redirect_target(struct sk_buff **pskb,
                 newdst = 0;
                 
                 rcu_read_lock();
-                indev = __in_dev_get((*pskb)->dev);
+                indev = __in_dev_get_rcu((*pskb)->dev);
                 if (indev && (ifa = indev->ifa_list))
                         newdst = ifa->ifa_local;
                 rcu_read_unlock();
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8549f26e2495..381dd6a6aebb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2128,7 +2128,7 @@ int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr,
                 struct in_device *in_dev;
 
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) != NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) != NULL) {
                         int our = ip_check_mc(in_dev, daddr, saddr,
                                 skb->nh.iph->protocol);
                         if (our
@@ -2443,7 +2443,9 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                 err = -ENODEV;
                 if (dev_out == NULL)
                         goto out;
-                if (__in_dev_get(dev_out) == NULL) {
+
+                /* RACE: Check return value of inet_select_addr instead. */
+                if (__in_dev_get_rtnl(dev_out) == NULL) {
                         dev_put(dev_out);
                         goto out;       /* Wrong error code */
                 }