7 files changed, 95 insertions, 94 deletions

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d2b6f54a6261..5cafdd4c8018 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,7 +280,7 @@ replay:
                 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
                         spin_lock_bh(root_lock);
                         *back = tp->next;
-                        spin_lock_bh(root_lock);
+                        spin_unlock_bh(root_lock);
 
                         tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
                         tcf_destroy(tp);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c25465e5607a..e7fb9e0d21b4 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -27,6 +27,7 @@
 #include <linux/kmod.h>
 #include <linux/list.h>
 #include <linux/hrtimer.h>
+#include <linux/lockdep.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -198,19 +199,53 @@ struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
         return NULL;
 }
 
+/*
+ * This lock is needed until some qdiscs stop calling qdisc_tree_decrease_qlen()
+ * without rtnl_lock(); currently hfsc_dequeue(), netem_dequeue(), tbf_dequeue()
+ */
+static DEFINE_SPINLOCK(qdisc_list_lock);
+
+static void qdisc_list_add(struct Qdisc *q)
+{
+        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
+                spin_lock_bh(&qdisc_list_lock);
+                list_add_tail(&q->list, &qdisc_root_sleeping(q)->list);
+                spin_unlock_bh(&qdisc_list_lock);
+        }
+}
+
+void qdisc_list_del(struct Qdisc *q)
+{
+        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
+                spin_lock_bh(&qdisc_list_lock);
+                list_del(&q->list);
+                spin_unlock_bh(&qdisc_list_lock);
+        }
+}
+EXPORT_SYMBOL(qdisc_list_del);
+
 struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
         unsigned int i;
+        struct Qdisc *q;
+
+        spin_lock_bh(&qdisc_list_lock);
 
         for (i = 0; i < dev->num_tx_queues; i++) {
                 struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
-                struct Qdisc *q, *txq_root = txq->qdisc_sleeping;
+                struct Qdisc *txq_root = txq->qdisc_sleeping;
 
                 q = qdisc_match_from_root(txq_root, handle);
                 if (q)
-                        return q;
+                        goto unlock;
         }
-        return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
+
+        q = qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
+
+unlock:
+        spin_unlock_bh(&qdisc_list_lock);
+
+        return q;
 }
 
 static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
@@ -331,7 +366,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (!s || tsize != s->tsize || (!tab && tsize > 0))
                 return ERR_PTR(-EINVAL);
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
 
         list_for_each_entry(stab, &qdisc_stab_list, list) {
                 if (memcmp(&stab->szopts, s, sizeof(*s)))
@@ -339,11 +374,11 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
                 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16)))
                         continue;
                 stab->refcnt++;
-                spin_unlock_bh(&qdisc_stab_lock);
+                spin_unlock(&qdisc_stab_lock);
                 return stab;
         }
 
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 
         stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
         if (!stab)
@@ -354,9 +389,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (tsize > 0)
                 memcpy(stab->data, tab, tsize * sizeof(u16));
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
         list_add_tail(&stab->list, &qdisc_stab_list);
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 
         return stab;
 }
@@ -366,14 +401,14 @@ void qdisc_put_stab(struct qdisc_size_table *tab)
         if (!tab)
                 return;
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
 
         if (--tab->refcnt == 0) {
                 list_del(&tab->list);
                 kfree(tab);
         }
 
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 }
 EXPORT_SYMBOL(qdisc_put_stab);
 
@@ -426,7 +461,7 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 
         wd->qdisc->flags &= ~TCQ_F_THROTTLED;
         smp_wmb();
-        __netif_schedule(wd->qdisc);
+        __netif_schedule(qdisc_root(wd->qdisc));
 
         return HRTIMER_NORESTART;
 }
@@ -443,6 +478,10 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
 {
         ktime_t time;
 
+        if (test_bit(__QDISC_STATE_DEACTIVATED,
+                     &qdisc_root_sleeping(wd->qdisc)->state))
+                return;
+
         wd->qdisc->flags |= TCQ_F_THROTTLED;
         time = ktime_set(0, 0);
         time = ktime_add_ns(time, PSCHED_US2NS(expires));
@@ -637,11 +676,8 @@ static void notify_and_destroy(struct sk_buff *skb, struct nlmsghdr *n, u32 clid
         if (new || old)
                 qdisc_notify(skb, n, clid, old, new);
 
-        if (old) {
-                spin_lock_bh(&old->q.lock);
+        if (old)
                 qdisc_destroy(old);
-                spin_unlock_bh(&old->q.lock);
-        }
 }
 
 /* Graft qdisc "new" to class "classid" of qdisc "parent" or
@@ -707,6 +743,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
         return err;
 }
 
+/* lockdep annotation is needed for ingress; egress gets it only for name */
+static struct lock_class_key qdisc_tx_lock;
+static struct lock_class_key qdisc_rx_lock;
+
 /*
    Allocate and initialize new qdisc.
 
@@ -767,6 +807,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
         if (handle == TC_H_INGRESS) {
                 sch->flags |= TCQ_F_INGRESS;
                 handle = TC_H_MAKE(TC_H_INGRESS, 0);
+                lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
         } else {
                 if (handle == 0) {
                         handle = qdisc_alloc_handle(dev);
@@ -774,6 +815,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                         if (handle == 0)
                                 goto err_out3;
                 }
+                lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
         }
 
         sch->handle = handle;
@@ -802,8 +844,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                                 goto err_out3;
                         }
                 }
-                if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS))
-                        list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list);
+
+                qdisc_list_add(sch);
 
                 return sch;
         }
@@ -1084,20 +1126,13 @@ create_n_graft:
         }
 
 graft:
-        if (1) {
-                spinlock_t *root_lock;
-
-                err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
-                if (err) {
-                        if (q) {
-                                root_lock = qdisc_root_lock(q);
-                                spin_lock_bh(root_lock);
-                                qdisc_destroy(q);
-                                spin_unlock_bh(root_lock);
-                        }
-                        return err;
-                }
+        err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
+        if (err) {
+                if (q)
+                        qdisc_destroy(q);
+                return err;
         }
+
         return 0;
 }
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4e261ce62f48..8fa90d68ec6d 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -521,6 +521,10 @@ static void cbq_ovl_delay(struct cbq_class *cl)
         struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
         psched_tdiff_t delay = cl->undertime - q->now;
 
+        if (test_bit(__QDISC_STATE_DEACTIVATED,
+                     &qdisc_root_sleeping(cl->qdisc)->state))
+                return;
+
         if (!cl->delayed) {
                 psched_time_t sched = q->now;
                 ktime_t expires;
@@ -654,7 +658,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
         }
 
         sch->flags &= ~TCQ_F_THROTTLED;
-        __netif_schedule(sch);
+        __netif_schedule(qdisc_root(sch));
         return HRTIMER_NORESTART;
 }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 468574682caa..5f0ade7806a7 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -518,15 +518,17 @@ void qdisc_reset(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_reset);
 
-/* this is the rcu callback function to clean up a qdisc when there
- * are no further references to it */
-
-static void __qdisc_destroy(struct rcu_head *head)
+void qdisc_destroy(struct Qdisc *qdisc)
 {
-        struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
         const struct Qdisc_ops  *ops = qdisc->ops;
 
+        if (qdisc->flags & TCQ_F_BUILTIN ||
+            !atomic_dec_and_test(&qdisc->refcnt))
+                return;
+
 #ifdef CONFIG_NET_SCHED
+        qdisc_list_del(qdisc);
+
         qdisc_put_stab(qdisc->stab);
 #endif
         gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est);
@@ -542,20 +544,6 @@ static void __qdisc_destroy(struct rcu_head *head)
 
         kfree((char *) qdisc - qdisc->padded);
 }
-
-/* Under qdisc_lock(qdisc) and BH! */
-
-void qdisc_destroy(struct Qdisc *qdisc)
-{
-        if (qdisc->flags & TCQ_F_BUILTIN ||
-            !atomic_dec_and_test(&qdisc->refcnt))
-                return;
-
-        if (qdisc->parent)
-                list_del(&qdisc->list);
-
-        call_rcu(&qdisc->q_rcu, __qdisc_destroy);
-}
 EXPORT_SYMBOL(qdisc_destroy);
 
 static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
@@ -597,6 +585,9 @@ static void transition_one_qdisc(struct net_device *dev,
         struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping;
         int *need_watchdog_p = _need_watchdog;
 
+        if (!(new_qdisc->flags & TCQ_F_BUILTIN))
+                clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
+
         rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
         if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
                 *need_watchdog_p = 1;
@@ -640,6 +631,9 @@ static void dev_deactivate_queue(struct net_device *dev,
         if (qdisc) {
                 spin_lock_bh(qdisc_lock(qdisc));
 
+                if (!(qdisc->flags & TCQ_F_BUILTIN))
+                        set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
+
                 dev_queue->qdisc = qdisc_default;
                 qdisc_reset(qdisc);
 
@@ -647,7 +641,7 @@ static void dev_deactivate_queue(struct net_device *dev,
         }
 }
 
-static bool some_qdisc_is_busy(struct net_device *dev, int lock)
+static bool some_qdisc_is_busy(struct net_device *dev)
 {
         unsigned int i;
 
@@ -661,14 +655,12 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
                 q = dev_queue->qdisc_sleeping;
                 root_lock = qdisc_lock(q);
 
-                if (lock)
-                        spin_lock_bh(root_lock);
+                spin_lock_bh(root_lock);
 
                 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
                        test_bit(__QDISC_STATE_SCHED, &q->state));
 
-                if (lock)
-                        spin_unlock_bh(root_lock);
+                spin_unlock_bh(root_lock);
 
                 if (val)
                         return true;
@@ -678,8 +670,6 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
 
 void dev_deactivate(struct net_device *dev)
 {
-        bool running;
-
         netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
         dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
 
@@ -689,25 +679,8 @@ void dev_deactivate(struct net_device *dev)
         synchronize_rcu();
 
         /* Wait for outstanding qdisc_run calls. */
-        do {
-                while (some_qdisc_is_busy(dev, 0))
-                        yield();
-
-                /*
-                 * Double-check inside queue lock to ensure that all effects
-                 * of the queue run are visible when we return.
-                 */
-                running = some_qdisc_is_busy(dev, 1);
-
-                /*
-                 * The running flag should never be set at this point because
-                 * we've already set dev->qdisc to noop_qdisc *inside* the same
-                 * pair of spin locks.  That is, if any qdisc_run starts after
-                 * our initial test it should see the noop_qdisc and then
-                 * clear the RUNNING bit before dropping the queue lock.  So
-                 * if it is set here then we've found a bug.
-                 */
-        } while (WARN_ON_ONCE(running));
+        while (some_qdisc_is_busy(dev))
+                yield();
 }
 
 static void dev_init_scheduler_queue(struct net_device *dev,
@@ -736,14 +709,10 @@ static void shutdown_scheduler_queue(struct net_device *dev,
         struct Qdisc *qdisc_default = _qdisc_default;
 
         if (qdisc) {
-                spinlock_t *root_lock = qdisc_lock(qdisc);
-
                 dev_queue->qdisc = qdisc_default;
                 dev_queue->qdisc_sleeping = qdisc_default;
 
-                spin_lock_bh(root_lock);
                 qdisc_destroy(qdisc);
-                spin_unlock_bh(root_lock);
         }
 }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6febd245e62b..0df0df202ed0 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                         sch->qstats.drops++;
                         cl->qstats.drops++;
                 }
-                return NET_XMIT_DROP;
+                return ret;
         } else {
                 cl->bstats.packets +=
                         skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                         sch->qstats.drops++;
                         cl->qstats.drops++;
                 }
-                return NET_XMIT_DROP;
+                return ret;
         } else
                 htb_activate(q, cl);
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index eac197610edf..a6697c686c7f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -113,11 +113,11 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
         if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
                 sch->q.qlen++;
                 sch->qstats.requeues++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
         if (net_xmit_drop_count(ret))
                 sch->qstats.drops++;
-        return NET_XMIT_DROP;
+        return ret;
 }
 
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7d3b7ff3bf07..94c61598b86a 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
         int ret;
 
-        if (qdisc_pkt_len(skb) > q->max_size) {
-                sch->qstats.drops++;
-#ifdef CONFIG_NET_CLS_ACT
-                if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
-#endif
-                        kfree_skb(skb);
-
-                return NET_XMIT_DROP;
-        }
+        if (qdisc_pkt_len(skb) > q->max_size)
+                return qdisc_reshape_fail(skb, sch);
 
         ret = qdisc_enqueue(skb, q->qdisc);
         if (ret != 0) {