cls_rsvp: add sanity check for the packet length

[mv-sheeva.git] / net / ipv4 / igmp.c

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 5fff865a4fa745c02cf93e65323f3316ae8299d0..a1ad0e7180d2bd7051df4f78bed75fbb7612da40 100644 (file)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -312,7 +312,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                return NULL;
        }
 
-       skb_dst_set(skb, &rt->u.dst);
+       skb_dst_set(skb, &rt->dst);
        skb->dev = dev;
 
        skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -330,7 +330,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
        pip->saddr    = rt->rt_src;
        pip->protocol = IPPROTO_IGMP;
        pip->tot_len  = 0;      /* filled in later */
-       ip_select_ident(pip, &rt->u.dst, NULL);
+       ip_select_ident(pip, &rt->dst, NULL);
        ((u8*)&pip[1])[0] = IPOPT_RA;
        ((u8*)&pip[1])[1] = 4;
        ((u8*)&pip[1])[2] = 0;
@@ -660,7 +660,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                return -1;
        }
 
-       skb_dst_set(skb, &rt->u.dst);
+       skb_dst_set(skb, &rt->dst);
 
        skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
@@ -676,7 +676,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
        iph->daddr    = dst;
        iph->saddr    = rt->rt_src;
        iph->protocol = IPPROTO_IGMP;
-       ip_select_ident(iph, &rt->u.dst, NULL);
+       ip_select_ident(iph, &rt->dst, NULL);
        ((u8*)&iph[1])[0] = IPOPT_RA;
        ((u8*)&iph[1])[1] = 4;
        ((u8*)&iph[1])[2] = 0;
@@ -916,18 +916,19 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
        read_unlock(&in_dev->mc_list_lock);
 }
 
+/* called in rcu_read_lock() section */
 int igmp_rcv(struct sk_buff *skb)
 {
        /* This basically follows the spec line by line -- see RFC1112 */
        struct igmphdr *ih;
-       struct in_device *in_dev = in_dev_get(skb->dev);
+       struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
        int len = skb->len;
 
        if (in_dev == NULL)
                goto drop;
 
        if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
-               goto drop_ref;
+               goto drop;
 
        switch (skb->ip_summed) {
        case CHECKSUM_COMPLETE:
@@ -937,7 +938,7 @@ int igmp_rcv(struct sk_buff *skb)
        case CHECKSUM_NONE:
                skb->csum = 0;
                if (__skb_checksum_complete(skb))
-                       goto drop_ref;
+                       goto drop;
        }
 
        ih = igmp_hdr(skb);
@@ -957,7 +958,6 @@ int igmp_rcv(struct sk_buff *skb)
                break;
        case IGMP_PIM:
 #ifdef CONFIG_IP_PIMSM_V1
-               in_dev_put(in_dev);
                return pim_rcv_v1(skb);
 #endif
        case IGMPV3_HOST_MEMBERSHIP_REPORT:
@@ -971,8 +971,6 @@ int igmp_rcv(struct sk_buff *skb)
                break;
        }
 
-drop_ref:
-       in_dev_put(in_dev);
 drop:
        kfree_skb(skb);
        return 0;
@@ -1246,6 +1244,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 out:
        return;
 }
+EXPORT_SYMBOL(ip_mc_inc_group);
 
 /*
  *     Resend IGMP JOIN report; used for bonding.
@@ -1268,6 +1267,7 @@ void ip_mc_rejoin_group(struct ip_mc_list *im)
        igmp_ifc_event(in_dev);
 #endif
 }
+EXPORT_SYMBOL(ip_mc_rejoin_group);
 
 /*
  *     A socket has left a multicast group on device dev
@@ -1298,6 +1298,7 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
                }
        }
 }
+EXPORT_SYMBOL(ip_mc_dec_group);
 
 /* Device changing type */
 
@@ -1427,7 +1428,7 @@ static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
        }
 
        if (!dev && !ip_route_output_key(net, &rt, &fl)) {
-               dev = rt->u.dst.dev;
+               dev = rt->dst.dev;
                ip_rt_put(rt);
        }
        if (dev) {
@@ -1646,8 +1647,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                                if (dpsf->sf_inaddr == psf->sf_inaddr)
                                        break;
                        if (!dpsf) {
-                               dpsf = (struct ip_sf_list *)
-                                       kmalloc(sizeof(*dpsf), GFP_ATOMIC);
+                               dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
                                if (!dpsf)
                                        continue;
                                *dpsf = *psf;
@@ -1807,6 +1807,7 @@ done:
        rtnl_unlock();
        return err;
 }
+EXPORT_SYMBOL(ip_mc_join_group);
 
 static void ip_sf_socklist_reclaim(struct rcu_head *rp)
 {
@@ -2679,8 +2680,3 @@ int __init igmp_mc_proc_init(void)
        return register_pernet_subsys(&igmp_net_ops);
 }
 #endif
-
-EXPORT_SYMBOL(ip_mc_dec_group);
-EXPORT_SYMBOL(ip_mc_inc_group);
-EXPORT_SYMBOL(ip_mc_join_group);
-EXPORT_SYMBOL(ip_mc_rejoin_group);