[NETFILTER]: conntrack: add '_get' to {ip, nf}_conntrack_expect_find

[karo-tx-linux.git] / net / ipv4 / netfilter / ip_conntrack_core.c

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 2568d480e9a92a6b6e78a0727fcac449693fb44e..4d1f954d459b061a4bf8e84f15dfc443b5542e55 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -63,17 +63,17 @@ atomic_t ip_conntrack_count = ATOMIC_INIT(0);
 
 void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack) = NULL;
 LIST_HEAD(ip_conntrack_expect_list);
-struct ip_conntrack_protocol *ip_ct_protos[MAX_IP_CT_PROTO];
+struct ip_conntrack_protocol *ip_ct_protos[MAX_IP_CT_PROTO] __read_mostly;
 static LIST_HEAD(helpers);
 unsigned int ip_conntrack_htable_size __read_mostly = 0;
 int ip_conntrack_max __read_mostly;
-struct list_head *ip_conntrack_hash;
+struct list_head *ip_conntrack_hash __read_mostly;
 static kmem_cache_t *ip_conntrack_cachep __read_mostly;
 static kmem_cache_t *ip_conntrack_expect_cachep __read_mostly;
 struct ip_conntrack ip_conntrack_untracked;
 unsigned int ip_ct_log_invalid __read_mostly;
 static LIST_HEAD(unconfirmed);
-static int ip_conntrack_vmalloc;
+static int ip_conntrack_vmalloc __read_mostly;
 
 static unsigned int ip_conntrack_next_id;
 static unsigned int ip_conntrack_expect_next_id;
@@ -149,8 +149,8 @@ static unsigned int ip_conntrack_hash_rnd;
 static u_int32_t __hash_conntrack(const struct ip_conntrack_tuple *tuple,
                            unsigned int size, unsigned int rnd)
 {
-       return (jhash_3words(tuple->src.ip,
-                            (tuple->dst.ip ^ tuple->dst.protonum),
+       return (jhash_3words((__force u32)tuple->src.ip,
+                            ((__force u32)tuple->dst.ip ^ tuple->dst.protonum),
                             (tuple->src.u.all | (tuple->dst.u.all << 16)),
                             rnd) % size);
 }
@@ -225,22 +225,22 @@ __ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
        struct ip_conntrack_expect *i;
        
        list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-               if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-                       atomic_inc(&i->use);
+               if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
                        return i;
-               }
        }
        return NULL;
 }
 
 /* Just find a expectation corresponding to a tuple. */
 struct ip_conntrack_expect *
-ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
+ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple)
 {
        struct ip_conntrack_expect *i;
        
        read_lock_bh(&ip_conntrack_lock);
        i = __ip_conntrack_expect_find(tuple);
+       if (i)
+               atomic_inc(&i->use);
        read_unlock_bh(&ip_conntrack_lock);
 
        return i;
@@ -307,6 +307,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
 {
        struct ip_conntrack *ct = (struct ip_conntrack *)nfct;
        struct ip_conntrack_protocol *proto;
+       struct ip_conntrack_helper *helper;
 
        DEBUGP("destroy_conntrack(%p)\n", ct);
        IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
@@ -315,6 +316,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
        ip_conntrack_event(IPCT_DESTROY, ct);
        set_bit(IPS_DYING_BIT, &ct->status);
 
+       helper = ct->helper;
+       if (helper && helper->destroy)
+               helper->destroy(ct);
+
        /* To make sure we don't get any weird locking issues here:
         * destroy_conntrack() MUST NOT be called with a write lock
         * to ip_conntrack_lock!!! -HW */
@@ -622,11 +627,15 @@ struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
                ip_conntrack_hash_rnd_initted = 1;
        }
 
+       /* We don't want any race condition at early drop stage */
+       atomic_inc(&ip_conntrack_count);
+
        if (ip_conntrack_max
-           && atomic_read(&ip_conntrack_count) >= ip_conntrack_max) {
+           && atomic_read(&ip_conntrack_count) > ip_conntrack_max) {
                unsigned int hash = hash_conntrack(orig);
                /* Try dropping from this hash chain. */
                if (!early_drop(&ip_conntrack_hash[hash])) {
+                       atomic_dec(&ip_conntrack_count);
                        if (net_ratelimit())
                                printk(KERN_WARNING
                                       "ip_conntrack: table full, dropping"
@@ -638,6 +647,7 @@ struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
        conntrack = kmem_cache_alloc(ip_conntrack_cachep, GFP_ATOMIC);
        if (!conntrack) {
                DEBUGP("Can't allocate conntrack.\n");
+               atomic_dec(&ip_conntrack_count);
                return ERR_PTR(-ENOMEM);
        }
 
@@ -651,8 +661,6 @@ struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
        conntrack->timeout.data = (unsigned long)conntrack;
        conntrack->timeout.function = death_by_timeout;
 
-       atomic_inc(&ip_conntrack_count);
-
        return conntrack;
 }
 
@@ -1161,9 +1169,9 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
 int ip_ct_port_tuple_to_nfattr(struct sk_buff *skb,
                               const struct ip_conntrack_tuple *tuple)
 {
-       NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
+       NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(__be16),
                &tuple->src.u.tcp.port);
-       NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
+       NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(__be16),
                &tuple->dst.u.tcp.port);
        return 0;
 
@@ -1178,9 +1186,9 @@ int ip_ct_port_nfattr_to_tuple(struct nfattr *tb[],
                return -EINVAL;
 
        t->src.u.tcp.port =
-               *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
+               *(__be16 *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
        t->dst.u.tcp.port =
-               *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
+               *(__be16 *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
 
        return 0;
 }