5 files changed, 120 insertions, 67 deletions

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index c4d1a1da813c..f49f3dd6fbd3 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -140,6 +140,7 @@ static struct proto llc_proto = {
         .name     = "LLC",
         .owner    = THIS_MODULE,
         .obj_size = sizeof(struct llc_sock),
+        .slab_flags = SLAB_DESTROY_BY_RCU,
 };
 
 /**
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index c6bab39b018e..77bb3816655e 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -468,6 +468,19 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
         return rc;
 }
 
+static inline bool llc_estab_match(const struct llc_sap *sap,
+                                   const struct llc_addr *daddr,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return llc->laddr.lsap == laddr->lsap &&
+                llc->daddr.lsap == daddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac) &&
+                llc_mac_match(llc->daddr.mac, daddr->mac);
+}
+
 /**
  *      __llc_lookup_established - Finds connection for the remote/local sap/mac
  *      @sap: SAP
@@ -484,23 +497,26 @@ static struct sock *__llc_lookup_established(struct llc_sap *sap,
                                              struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (llc->laddr.lsap == laddr->lsap &&
-                    llc->daddr.lsap == daddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                    llc_mac_match(llc->daddr.mac, daddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, &sap->sk_list) {
+                if (llc_estab_match(sap, daddr, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_estab_match(sap, daddr, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
 found:
-        read_unlock(&sap->sk_list.lock);
+        rcu_read_unlock();
         return rc;
 }
 
@@ -516,6 +532,18 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
         return sk;
 }
 
+static inline bool llc_listener_match(const struct llc_sap *sap,
+                                      const struct llc_addr *laddr,
+                                      const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
+                llc->laddr.lsap == laddr->lsap &&
+                (llc_mac_match(llc->laddr.mac, laddr->mac) ||
+                 llc_mac_null(llc->laddr.mac));
+}
+
 /**
  *      llc_lookup_listener - Finds listener for local MAC + SAP
  *      @sap: SAP
@@ -530,23 +558,26 @@ static struct sock *llc_lookup_listener(struct llc_sap *sap,
                                         struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (rc->sk_type == SOCK_STREAM && rc->sk_state == TCP_LISTEN &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    (llc_mac_match(llc->laddr.mac, laddr->mac) ||
-                     llc_mac_null(llc->laddr.mac))) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, &sap->sk_list) {
+                if (llc_listener_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_listener_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
 found:
-        read_unlock(&sap->sk_list.lock);
+        rcu_read_unlock();
         return rc;
 }
 
@@ -652,10 +683,10 @@ static int llc_find_offset(int state, int ev_type)
 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
 {
         llc_sap_hold(sap);
-        write_lock_bh(&sap->sk_list.lock);
+        spin_lock_bh(&sap->sk_lock);
         llc_sk(sk)->sap = sap;
-        sk_add_node(sk, &sap->sk_list.list);
-        write_unlock_bh(&sap->sk_list.lock);
+        sk_nulls_add_node_rcu(sk, &sap->sk_list);
+        spin_unlock_bh(&sap->sk_lock);
 }
 
 /**
@@ -663,14 +694,14 @@ void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function removes a connection from sk_list.list of a SAP if
+ *      This function removes a connection from sk_list of a SAP if
  *      the connection was in this list.
  */
 void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 {
-        write_lock_bh(&sap->sk_list.lock);
-        sk_del_node_init(sk);
-        write_unlock_bh(&sap->sk_list.lock);
+        spin_lock_bh(&sap->sk_lock);
+        sk_nulls_del_node_init_rcu(sk);
+        spin_unlock_bh(&sap->sk_lock);
         llc_sap_put(sap);
 }
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ff4c0ab96a69..5276b9722077 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -37,7 +37,8 @@ static struct llc_sap *llc_sap_alloc(void)
         if (sap) {
                 /* sap->laddr.mac - leave as a null, it's filled by bind */
                 sap->state = LLC_SAP_STATE_ACTIVE;
-                rwlock_init(&sap->sk_list.lock);
+                spin_lock_init(&sap->sk_lock);
+                INIT_HLIST_NULLS_HEAD(&sap->sk_list, 0);
                 atomic_set(&sap->refcnt, 1);
         }
         return sap;
@@ -142,7 +143,7 @@ out:
  */
 void llc_sap_close(struct llc_sap *sap)
 {
-        WARN_ON(!hlist_empty(&sap->sk_list.list));
+        WARN_ON(!hlist_nulls_empty(&sap->sk_list));
         llc_del_sap(sap);
         kfree(sap);
 }
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index be47ac427f6b..6b3d033b3236 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -34,19 +34,19 @@ static struct sock *llc_get_sk_idx(loff_t pos)
 {
         struct list_head *sap_entry;
         struct llc_sap *sap;
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
         struct sock *sk = NULL;
 
         list_for_each(sap_entry, &llc_sap_list) {
                 sap = list_entry(sap_entry, struct llc_sap, node);
 
-                read_lock_bh(&sap->sk_list.lock);
-                sk_for_each(sk, node, &sap->sk_list.list) {
+                spin_lock_bh(&sap->sk_lock);
+                sk_nulls_for_each(sk, node, &sap->sk_list) {
                         if (!pos)
                                 goto found;
                         --pos;
                 }
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
         sk = NULL;
 found:
@@ -73,25 +73,25 @@ static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 goto out;
         }
         sk = v;
-        next = sk_next(sk);
+        next = sk_nulls_next(sk);
         if (next) {
                 sk = next;
                 goto out;
         }
         llc = llc_sk(sk);
         sap = llc->sap;
-        read_unlock_bh(&sap->sk_list.lock);
+        spin_unlock_bh(&sap->sk_lock);
         sk = NULL;
         for (;;) {
                 if (sap->node.next == &llc_sap_list)
                         break;
                 sap = list_entry(sap->node.next, struct llc_sap, node);
-                read_lock_bh(&sap->sk_list.lock);
-                if (!hlist_empty(&sap->sk_list.list)) {
-                        sk = sk_head(&sap->sk_list.list);
+                spin_lock_bh(&sap->sk_lock);
+                if (!hlist_nulls_empty(&sap->sk_list)) {
+                        sk = sk_nulls_head(&sap->sk_list);
                         break;
                 }
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
 out:
         return sk;
@@ -104,7 +104,7 @@ static void llc_seq_stop(struct seq_file *seq, void *v)
                 struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
         read_unlock_bh(&llc_sap_list_lock);
 }
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 008de1fc42ca..39760d013ce2 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -297,6 +297,17 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
         llc_sap_state_process(sap, skb);
 }
 
+static inline bool llc_dgram_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
 /**
  *      llc_lookup_dgram - Finds dgram socket for the local sap/mac
  *      @sap: SAP
@@ -309,25 +320,41 @@ static struct sock *llc_lookup_dgram(struct llc_sap *sap,
                                      const struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (rc->sk_type == SOCK_DGRAM &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+
+        rcu_read_lock_bh();
+again:
+        sk_nulls_for_each_rcu(rc, node, &sap->sk_list) {
+                if (llc_dgram_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_dgram_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        rcu_read_unlock_bh();
         return rc;
 }
 
+static inline bool llc_mcast_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sk_buff *skb,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc->dev == skb->dev;
+}
+
 /**
  *      llc_sap_mcast - Deliver multicast PDU's to all matching datagram sockets.
  *      @sap: SAP
@@ -341,20 +368,13 @@ static void llc_sap_mcast(struct llc_sap *sap,
                           struct sk_buff *skb)
 {
         struct sock *sk;
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
 
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(sk, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(sk);
+        spin_lock_bh(&sap->sk_lock);
+        sk_nulls_for_each_rcu(sk, node, &sap->sk_list) {
                 struct sk_buff *skb1;
 
-                if (sk->sk_type != SOCK_DGRAM)
-                        continue;
-
-                if (llc->laddr.lsap != laddr->lsap)
-                        continue;
-
-                if (llc->dev != skb->dev)
+                if (!llc_mcast_match(sap, laddr, skb, sk))
                         continue;
 
                 skb1 = skb_clone(skb, GFP_ATOMIC);
@@ -365,7 +385,7 @@ static void llc_sap_mcast(struct llc_sap *sap,
                 llc_sap_rcv(sap, skb1, sk);
                 sock_put(sk);
         }
-        read_unlock_bh(&sap->sk_list.lock);
+        spin_unlock_bh(&sap->sk_lock);
 }