9 files changed, 102 insertions, 96 deletions

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 972378f47f3c..23b25f89e7e0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -26,6 +26,11 @@
 #include <net/act_api.h>
 #include <net/netlink.h>
 
+static void tcf_common_free_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct tcf_common, tcfc_rcu));
+}
+
 void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
 {
         unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
@@ -38,7 +43,11 @@ void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
                         write_unlock_bh(hinfo->lock);
                         gen_kill_estimator(&p->tcfc_bstats,
                                            &p->tcfc_rate_est);
-                        kfree(p);
+                        /*
+                         * gen_estimator est_timer() might access p->tcfc_lock
+                         * or bstats, wait a RCU grace period before freeing p
+                         */
+                        call_rcu(&p->tcfc_rcu, tcf_common_free_rcu);
                         return;
                 }
         }
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 1980b71c283f..11f195af2da0 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -165,6 +165,8 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
 
         spin_lock(&m->tcf_lock);
         m->tcf_tm.lastuse = jiffies;
+        m->tcf_bstats.bytes += qdisc_pkt_len(skb);
+        m->tcf_bstats.packets++;
 
         dev = m->tcfm_dev;
         if (!dev) {
@@ -179,13 +181,11 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
                 goto out;
         }
 
-        skb2 = skb_act_clone(skb, GFP_ATOMIC);
+        at = G_TC_AT(skb->tc_verd);
+        skb2 = skb_act_clone(skb, GFP_ATOMIC, m->tcf_action);
         if (skb2 == NULL)
                 goto out;
 
-        m->tcf_bstats.bytes += qdisc_pkt_len(skb2);
-        m->tcf_bstats.packets++;
-        at = G_TC_AT(skb->tc_verd);
         if (!(at & AT_EGRESS)) {
                 if (m->tcfm_ok_push)
                         skb_push(skb2, skb2->dev->hard_header_len);
@@ -195,16 +195,14 @@ static int tcf_mirred(struct sk_buff *skb, struct tc_action *a,
         if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
                 skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
 
-        skb2->dev = dev;
         skb2->skb_iif = skb->dev->ifindex;
+        skb2->dev = dev;
         dev_queue_xmit(skb2);
         err = 0;
 
 out:
         if (err) {
                 m->tcf_qstats.overlimits++;
-                m->tcf_bstats.bytes += qdisc_pkt_len(skb);
-                m->tcf_bstats.packets++;
                 /* should we be asking for packet to be dropped?
                  * may make sense for redirect case only
                  */
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 724553e8ed7b..24e614c495f2 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -268,40 +268,29 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_nat *p = a->priv;
-        struct tc_nat *opt;
+        struct tc_nat opt;
         struct tcf_t t;
-        int s;
 
-        s = sizeof(*opt);
+        opt.old_addr = p->old_addr;
+        opt.new_addr = p->new_addr;
+        opt.mask = p->mask;
+        opt.flags = p->flags;
 
-        /* netlink spinlocks held above us - must use ATOMIC */
-        opt = kzalloc(s, GFP_ATOMIC);
-        if (unlikely(!opt))
-                return -ENOBUFS;
+        opt.index = p->tcf_index;
+        opt.action = p->tcf_action;
+        opt.refcnt = p->tcf_refcnt - ref;
+        opt.bindcnt = p->tcf_bindcnt - bind;
 
-        opt->old_addr = p->old_addr;
-        opt->new_addr = p->new_addr;
-        opt->mask = p->mask;
-        opt->flags = p->flags;
-
-        opt->index = p->tcf_index;
-        opt->action = p->tcf_action;
-        opt->refcnt = p->tcf_refcnt - ref;
-        opt->bindcnt = p->tcf_bindcnt - bind;
-
-        NLA_PUT(skb, TCA_NAT_PARMS, s, opt);
+        NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(p->tcf_tm.expires);
         NLA_PUT(skb, TCA_NAT_TM, sizeof(t), &t);
 
-        kfree(opt);
-
         return skb->len;
 
 nla_put_failure:
         nlmsg_trim(skb, b);
-        kfree(opt);
         return -1;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 50e3d945e1f4..a0593c9640db 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -127,8 +127,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
         int i, munged = 0;
         unsigned int off;
 
-        if (!(skb->tc_verd & TC_OK2MUNGE)) {
-                /* should we set skb->cloned? */
+        if (skb_cloned(skb)) {
                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
                         return p->tcf_action;
                 }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 654f73dff7c1..537a48732e9e 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -97,6 +97,11 @@ nla_put_failure:
         goto done;
 }
 
+static void tcf_police_free_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct tcf_police, tcf_rcu));
+}
+
 static void tcf_police_destroy(struct tcf_police *p)
 {
         unsigned int h = tcf_hash(p->tcf_index, POL_TAB_MASK);
@@ -113,7 +118,11 @@ static void tcf_police_destroy(struct tcf_police *p)
                                 qdisc_put_rtab(p->tcfp_R_tab);
                         if (p->tcfp_P_tab)
                                 qdisc_put_rtab(p->tcfp_P_tab);
-                        kfree(p);
+                        /*
+                         * gen_estimator est_timer() might access p->tcf_lock
+                         * or bstats, wait a RCU grace period before freeing p
+                         */
+                        call_rcu(&p->tcf_rcu, tcf_police_free_rcu);
                         return;
                 }
         }
@@ -397,6 +406,7 @@ static void __exit
 police_cleanup_module(void)
 {
         tcf_unregister_action(&act_police_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s (tcf_police_free_rcu) */
 }
 
 module_init(police_init_module);
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 1b4bc691d7d1..4a1d640b0cf1 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -73,10 +73,10 @@ static int tcf_simp_release(struct tcf_defact *d, int bind)
 
 static int alloc_defdata(struct tcf_defact *d, char *defdata)
 {
-        d->tcfd_defdata = kstrndup(defdata, SIMP_MAX_DATA, GFP_KERNEL);
+        d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL);
         if (unlikely(!d->tcfd_defdata))
                 return -ENOMEM;
-
+        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
         return 0;
 }
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index fcbb86a486a2..e114f23d5eae 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -52,7 +52,7 @@ struct atm_flow_data {
         int                     ref;            /* reference count */
         struct gnet_stats_basic_packed  bstats;
         struct gnet_stats_queue qstats;
-        struct atm_flow_data    *next;
+        struct list_head        list;
         struct atm_flow_data    *excess;        /* flow for excess traffic;
                                                    NULL to set CLP instead */
         int                     hdr_len;
@@ -61,34 +61,23 @@ struct atm_flow_data {
 
 struct atm_qdisc_data {
         struct atm_flow_data    link;           /* unclassified skbs go here */
-        struct atm_flow_data    *flows;         /* NB: "link" is also on this
+        struct list_head        flows;          /* NB: "link" is also on this
                                                    list */
         struct tasklet_struct   task;           /* dequeue tasklet */
 };
 
 /* ------------------------- Class/flow operations ------------------------- */
 
-static int find_flow(struct atm_qdisc_data *qdisc, struct atm_flow_data *flow)
-{
-        struct atm_flow_data *walk;
-
-        pr_debug("find_flow(qdisc %p,flow %p)\n", qdisc, flow);
-        for (walk = qdisc->flows; walk; walk = walk->next)
-                if (walk == flow)
-                        return 1;
-        pr_debug("find_flow: not found\n");
-        return 0;
-}
-
 static inline struct atm_flow_data *lookup_flow(struct Qdisc *sch, u32 classid)
 {
         struct atm_qdisc_data *p = qdisc_priv(sch);
         struct atm_flow_data *flow;
 
-        for (flow = p->flows; flow; flow = flow->next)
+        list_for_each_entry(flow, &p->flows, list) {
                 if (flow->classid == classid)
-                        break;
-        return flow;
+                        return flow;
+        }
+        return NULL;
 }
 
 static int atm_tc_graft(struct Qdisc *sch, unsigned long arg,
@@ -99,7 +88,7 @@ static int atm_tc_graft(struct Qdisc *sch, unsigned long arg,
 
         pr_debug("atm_tc_graft(sch %p,[qdisc %p],flow %p,new %p,old %p)\n",
                 sch, p, flow, new, old);
-        if (!find_flow(p, flow))
+        if (list_empty(&flow->list))
                 return -EINVAL;
         if (!new)
                 new = &noop_qdisc;
@@ -146,20 +135,12 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
 {
         struct atm_qdisc_data *p = qdisc_priv(sch);
         struct atm_flow_data *flow = (struct atm_flow_data *)cl;
-        struct atm_flow_data **prev;
 
         pr_debug("atm_tc_put(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
         if (--flow->ref)
                 return;
         pr_debug("atm_tc_put: destroying\n");
-        for (prev = &p->flows; *prev; prev = &(*prev)->next)
-                if (*prev == flow)
-                        break;
-        if (!*prev) {
-                printk(KERN_CRIT "atm_tc_put: class %p not found\n", flow);
-                return;
-        }
-        *prev = flow->next;
+        list_del_init(&flow->list);
         pr_debug("atm_tc_put: qdisc %p\n", flow->q);
         qdisc_destroy(flow->q);
         tcf_destroy_chain(&flow->filter_list);
@@ -274,7 +255,7 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
                         error = -EINVAL;
                         goto err_out;
                 }
-                if (find_flow(p, flow)) {
+                if (!list_empty(&flow->list)) {
                         error = -EEXIST;
                         goto err_out;
                 }
@@ -313,8 +294,7 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
         flow->classid = classid;
         flow->ref = 1;
         flow->excess = excess;
-        flow->next = p->link.next;
-        p->link.next = flow;
+        list_add(&flow->list, &p->link.list);
         flow->hdr_len = hdr_len;
         if (hdr)
                 memcpy(flow->hdr, hdr, hdr_len);
@@ -335,7 +315,7 @@ static int atm_tc_delete(struct Qdisc *sch, unsigned long arg)
         struct atm_flow_data *flow = (struct atm_flow_data *)arg;
 
         pr_debug("atm_tc_delete(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
-        if (!find_flow(qdisc_priv(sch), flow))
+        if (list_empty(&flow->list))
                 return -EINVAL;
         if (flow->filter_list || flow == &p->link)
                 return -EBUSY;
@@ -361,12 +341,12 @@ static void atm_tc_walk(struct Qdisc *sch, struct qdisc_walker *walker)
         pr_debug("atm_tc_walk(sch %p,[qdisc %p],walker %p)\n", sch, p, walker);
         if (walker->stop)
                 return;
-        for (flow = p->flows; flow; flow = flow->next) {
-                if (walker->count >= walker->skip)
-                        if (walker->fn(sch, (unsigned long)flow, walker) < 0) {
-                                walker->stop = 1;
-                                break;
-                        }
+        list_for_each_entry(flow, &p->flows, list) {
+                if (walker->count >= walker->skip &&
+                    walker->fn(sch, (unsigned long)flow, walker) < 0) {
+                        walker->stop = 1;
+                        break;
+                }
                 walker->count++;
         }
 }
@@ -385,16 +365,17 @@ static struct tcf_proto **atm_tc_find_tcf(struct Qdisc *sch, unsigned long cl)
 static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct atm_qdisc_data *p = qdisc_priv(sch);
-        struct atm_flow_data *flow = NULL;      /* @@@ */
+        struct atm_flow_data *flow;
         struct tcf_result res;
         int result;
         int ret = NET_XMIT_POLICED;
 
         pr_debug("atm_tc_enqueue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
         result = TC_POLICE_OK;  /* be nice to gcc */
+        flow = NULL;
         if (TC_H_MAJ(skb->priority) != sch->handle ||
-            !(flow = (struct atm_flow_data *)atm_tc_get(sch, skb->priority)))
-                for (flow = p->flows; flow; flow = flow->next)
+            !(flow = (struct atm_flow_data *)atm_tc_get(sch, skb->priority))) {
+                list_for_each_entry(flow, &p->flows, list) {
                         if (flow->filter_list) {
                                 result = tc_classify_compat(skb,
                                                             flow->filter_list,
@@ -404,8 +385,13 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                                 flow = (struct atm_flow_data *)res.class;
                                 if (!flow)
                                         flow = lookup_flow(sch, res.classid);
-                                break;
+                                goto done;
                         }
+                }
+                flow = NULL;
+        done:
+                ;               
+        }
         if (!flow)
                 flow = &p->link;
         else {
@@ -477,7 +463,9 @@ static void sch_atm_dequeue(unsigned long data)
         struct sk_buff *skb;
 
         pr_debug("sch_atm_dequeue(sch %p,[qdisc %p])\n", sch, p);
-        for (flow = p->link.next; flow; flow = flow->next)
+        list_for_each_entry(flow, &p->flows, list) {
+                if (flow == &p->link)
+                        continue;
                 /*
                  * If traffic is properly shaped, this won't generate nasty
                  * little bursts. Otherwise, it may ... (but that's okay)
@@ -512,6 +500,7 @@ static void sch_atm_dequeue(unsigned long data)
                         /* atm.atm_options are already set by atm_tc_enqueue */
                         flow->vcc->send(flow->vcc, skb);
                 }
+        }
 }
 
 static struct sk_buff *atm_tc_dequeue(struct Qdisc *sch)
@@ -543,9 +532,10 @@ static unsigned int atm_tc_drop(struct Qdisc *sch)
         unsigned int len;
 
         pr_debug("atm_tc_drop(sch %p,[qdisc %p])\n", sch, p);
-        for (flow = p->flows; flow; flow = flow->next)
+        list_for_each_entry(flow, &p->flows, list) {
                 if (flow->q->ops->drop && (len = flow->q->ops->drop(flow->q)))
                         return len;
+        }
         return 0;
 }
 
@@ -554,7 +544,9 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt)
         struct atm_qdisc_data *p = qdisc_priv(sch);
 
         pr_debug("atm_tc_init(sch %p,[qdisc %p],opt %p)\n", sch, p, opt);
-        p->flows = &p->link;
+        INIT_LIST_HEAD(&p->flows);
+        INIT_LIST_HEAD(&p->link.list);
+        list_add(&p->link.list, &p->flows);
         p->link.q = qdisc_create_dflt(qdisc_dev(sch), sch->dev_queue,
                                       &pfifo_qdisc_ops, sch->handle);
         if (!p->link.q)
@@ -565,7 +557,6 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt)
         p->link.sock = NULL;
         p->link.classid = sch->handle;
         p->link.ref = 1;
-        p->link.next = NULL;
         tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);
         return 0;
 }
@@ -576,7 +567,7 @@ static void atm_tc_reset(struct Qdisc *sch)
         struct atm_flow_data *flow;
 
         pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
-        for (flow = p->flows; flow; flow = flow->next)
+        list_for_each_entry(flow, &p->flows, list)
                 qdisc_reset(flow->q);
         sch->q.qlen = 0;
 }
@@ -584,24 +575,17 @@ static void atm_tc_reset(struct Qdisc *sch)
 static void atm_tc_destroy(struct Qdisc *sch)
 {
         struct atm_qdisc_data *p = qdisc_priv(sch);
-        struct atm_flow_data *flow;
+        struct atm_flow_data *flow, *tmp;
 
         pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        for (flow = p->flows; flow; flow = flow->next)
+        list_for_each_entry(flow, &p->flows, list)
                 tcf_destroy_chain(&flow->filter_list);
 
-        /* races ? */
-        while ((flow = p->flows)) {
+        list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                 if (flow->ref > 1)
                         printk(KERN_ERR "atm_destroy: %p->ref = %d\n", flow,
                                flow->ref);
                 atm_tc_put(sch, (unsigned long)flow);
-                if (p->flows == flow) {
-                        printk(KERN_ERR "atm_destroy: putting flow %p didn't "
-                               "kill it\n", flow);
-                        p->flows = flow->next;  /* brute force */
-                        break;
-                }
         }
         tasklet_kill(&p->task);
 }
@@ -615,7 +599,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
 
         pr_debug("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
                 sch, p, flow, skb, tcm);
-        if (!find_flow(p, flow))
+        if (list_empty(&flow->list))
                 return -EINVAL;
         tcm->tcm_handle = flow->classid;
         tcm->tcm_info = flow->q->handle;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index a63029ef3edd..2aeb3a4386a1 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -96,7 +96,7 @@ static inline int handle_dev_cpu_collision(struct sk_buff *skb,
                  * Another cpu is holding lock, requeue & delay xmits for
                  * some time.
                  */
-                __get_cpu_var(softnet_data).cpu_collision++;
+                __this_cpu_inc(softnet_data.cpu_collision);
                 ret = dev_requeue_skb(skb, q);
         }
 
@@ -205,7 +205,7 @@ void __qdisc_run(struct Qdisc *q)
                 }
         }
 
-        clear_bit(__QDISC_STATE_RUNNING, &q->state);
+        qdisc_run_end(q);
 }
 
 unsigned long dev_trans_start(struct net_device *dev)
@@ -327,6 +327,24 @@ void netif_carrier_off(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_carrier_off);
 
+/**
+ *      netif_notify_peers - notify network peers about existence of @dev
+ *      @dev: network device
+ *
+ * Generate traffic such that interested network peers are aware of
+ * @dev, such as by generating a gratuitous ARP. This may be used when
+ * a device wants to inform the rest of the network about some sort of
+ * reconfiguration such as a failover event or virtual machine
+ * migration.
+ */
+void netif_notify_peers(struct net_device *dev)
+{
+        rtnl_lock();
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
+        rtnl_unlock();
+}
+EXPORT_SYMBOL(netif_notify_peers);
+
 /* "NOOP" scheduler: the best scheduler, recommended for all interfaces
    under all circumstances. It is difficult to invent anything faster or
    cheaper.
@@ -543,6 +561,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
 
         INIT_LIST_HEAD(&sch->list);
         skb_queue_head_init(&sch->q);
+        spin_lock_init(&sch->busylock);
         sch->ops = ops;
         sch->enqueue = ops->enqueue;
         sch->dequeue = ops->dequeue;
@@ -779,7 +798,7 @@ static bool some_qdisc_is_busy(struct net_device *dev)
 
                 spin_lock_bh(root_lock);
 
-                val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
+                val = (qdisc_is_running(q) ||
                        test_bit(__QDISC_STATE_SCHED, &q->state));
 
                 spin_unlock_bh(root_lock);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0b52b8de562c..4be8d04b262d 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1550,7 +1550,6 @@ static const struct Qdisc_class_ops htb_class_ops = {
 };
 
 static struct Qdisc_ops htb_qdisc_ops __read_mostly = {
-        .next           =       NULL,
         .cl_ops         =       &htb_class_ops,
         .id             =       "htb",
         .priv_size      =       sizeof(struct htb_sched),
@@ -1561,7 +1560,6 @@ static struct Qdisc_ops htb_qdisc_ops __read_mostly = {
         .init           =       htb_init,
         .reset          =       htb_reset,
         .destroy        =       htb_destroy,
-        .change         =       NULL /* htb_change */,
         .dump           =       htb_dump,
         .owner          =       THIS_MODULE,
 };