2 files changed, 61 insertions, 13 deletions

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b7754b1b73a4..ef9ccbc38752 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -34,7 +34,7 @@
 
 #include "xfrm_hash.h"
 
-int sysctl_xfrm_larval_drop __read_mostly;
+int sysctl_xfrm_larval_drop __read_mostly = 1;
 
 #ifdef CONFIG_XFRM_STATISTICS
 DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics) __read_mostly;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 0a8f09c3144c..053970e8765d 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -59,6 +59,14 @@ static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
 static unsigned int xfrm_state_num;
 static unsigned int xfrm_state_genid;
 
+/* Counter indicating ongoing walk, protected by xfrm_state_lock. */
+static unsigned long xfrm_state_walk_ongoing;
+/* Counter indicating walk completion, protected by xfrm_cfg_mutex. */
+static unsigned long xfrm_state_walk_completed;
+
+/* List of outstanding state walks used to set the completed counter.  */
+static LIST_HEAD(xfrm_state_walks);
+
 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned int family);
 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
 
@@ -191,7 +199,8 @@ static DEFINE_RWLOCK(xfrm_state_afinfo_lock);
 static struct xfrm_state_afinfo *xfrm_state_afinfo[NPROTO];
 
 static struct work_struct xfrm_state_gc_work;
-static HLIST_HEAD(xfrm_state_gc_list);
+static LIST_HEAD(xfrm_state_gc_leftovers);
+static LIST_HEAD(xfrm_state_gc_list);
 static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 
 int __xfrm_state_delete(struct xfrm_state *x);
@@ -403,17 +412,23 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
 
 static void xfrm_state_gc_task(struct work_struct *data)
 {
-        struct xfrm_state *x;
-        struct hlist_node *entry, *tmp;
-        struct hlist_head gc_list;
+        struct xfrm_state *x, *tmp;
+        unsigned long completed;
 
+        mutex_lock(&xfrm_cfg_mutex);
         spin_lock_bh(&xfrm_state_gc_lock);
-        gc_list.first = xfrm_state_gc_list.first;
-        INIT_HLIST_HEAD(&xfrm_state_gc_list);
+        list_splice_tail_init(&xfrm_state_gc_list, &xfrm_state_gc_leftovers);
         spin_unlock_bh(&xfrm_state_gc_lock);
 
-        hlist_for_each_entry_safe(x, entry, tmp, &gc_list, bydst)
+        completed = xfrm_state_walk_completed;
+        mutex_unlock(&xfrm_cfg_mutex);
+
+        list_for_each_entry_safe(x, tmp, &xfrm_state_gc_leftovers, gclist) {
+                if ((long)(x->lastused - completed) > 0)
+                        break;
+                list_del(&x->gclist);
                 xfrm_state_gc_destroy(x);
+        }
 
         wake_up(&km_waitq);
 }
@@ -540,12 +555,8 @@ void __xfrm_state_destroy(struct xfrm_state *x)
 {
         WARN_ON(x->km.state != XFRM_STATE_DEAD);
 
-        spin_lock_bh(&xfrm_state_lock);
-        list_del(&x->all);
-        spin_unlock_bh(&xfrm_state_lock);
-
         spin_lock_bh(&xfrm_state_gc_lock);
-        hlist_add_head(&x->bydst, &xfrm_state_gc_list);
+        list_add_tail(&x->gclist, &xfrm_state_gc_list);
         spin_unlock_bh(&xfrm_state_gc_lock);
         schedule_work(&xfrm_state_gc_work);
 }
@@ -558,6 +569,8 @@ int __xfrm_state_delete(struct xfrm_state *x)
         if (x->km.state != XFRM_STATE_DEAD) {
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
+                x->lastused = xfrm_state_walk_ongoing;
+                list_del_rcu(&x->all);
                 hlist_del(&x->bydst);
                 hlist_del(&x->bysrc);
                 if (x->id.spi)
@@ -1594,6 +1607,41 @@ out:
 }
 EXPORT_SYMBOL(xfrm_state_walk);
 
+void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
+{
+        walk->proto = proto;
+        walk->state = NULL;
+        walk->count = 0;
+        list_add_tail(&walk->list, &xfrm_state_walks);
+        walk->genid = ++xfrm_state_walk_ongoing;
+}
+EXPORT_SYMBOL(xfrm_state_walk_init);
+
+void xfrm_state_walk_done(struct xfrm_state_walk *walk)
+{
+        struct list_head *prev;
+
+        if (walk->state != NULL) {
+                xfrm_state_put(walk->state);
+                walk->state = NULL;
+        }
+
+        prev = walk->list.prev;
+        list_del(&walk->list);
+
+        if (prev != &xfrm_state_walks) {
+                list_entry(prev, struct xfrm_state_walk, list)->genid =
+                        walk->genid;
+                return;
+        }
+
+        xfrm_state_walk_completed = walk->genid;
+
+        if (!list_empty(&xfrm_state_gc_leftovers))
+                schedule_work(&xfrm_state_gc_work);
+}
+EXPORT_SYMBOL(xfrm_state_walk_done);
+
 
 void xfrm_replay_notify(struct xfrm_state *x, int event)
 {