Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

[linux-2.6-microblaze.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2e61aab..fec814d 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1216,7 +1216,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
                if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
                        goto nla_put_failure;
 
-               if (basechain->stats && nft_dump_stats(skb, basechain->stats))
+               if (rcu_access_pointer(basechain->stats) &&
+                   nft_dump_stats(skb, rcu_dereference(basechain->stats)))
                        goto nla_put_failure;
        }
 
@@ -1392,7 +1393,8 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
        return newstats;
 }
 
-static void nft_chain_stats_replace(struct nft_base_chain *chain,
+static void nft_chain_stats_replace(struct net *net,
+                                   struct nft_base_chain *chain,
                                    struct nft_stats __percpu *newstats)
 {
        struct nft_stats __percpu *oldstats;
@@ -1400,8 +1402,9 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
        if (newstats == NULL)
                return;
 
-       if (chain->stats) {
-               oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
+       if (rcu_access_pointer(chain->stats)) {
+               oldstats = rcu_dereference_protected(chain->stats,
+                                       lockdep_commit_lock_is_held(net));
                rcu_assign_pointer(chain->stats, newstats);
                synchronize_rcu();
                free_percpu(oldstats);
@@ -1439,9 +1442,10 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
                struct nft_base_chain *basechain = nft_base_chain(chain);
 
                module_put(basechain->type->owner);
-               free_percpu(basechain->stats);
-               if (basechain->stats)
+               if (rcu_access_pointer(basechain->stats)) {
                        static_branch_dec(&nft_counters_enabled);
+                       free_percpu(rcu_dereference_raw(basechain->stats));
+               }
                kfree(chain->name);
                kfree(basechain);
        } else {
@@ -1590,7 +1594,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
                                kfree(basechain);
                                return PTR_ERR(stats);
                        }
-                       basechain->stats = stats;
+                       rcu_assign_pointer(basechain->stats, stats);
                        static_branch_inc(&nft_counters_enabled);
                }
 
@@ -2291,15 +2295,52 @@ struct nft_rule_dump_ctx {
        char *chain;
 };
 
+static int __nf_tables_dump_rules(struct sk_buff *skb,
+                                 unsigned int *idx,
+                                 struct netlink_callback *cb,
+                                 const struct nft_table *table,
+                                 const struct nft_chain *chain)
+{
+       struct net *net = sock_net(skb->sk);
+       unsigned int s_idx = cb->args[0];
+       const struct nft_rule *rule;
+       int rc = 1;
+
+       list_for_each_entry_rcu(rule, &chain->rules, list) {
+               if (!nft_is_active(net, rule))
+                       goto cont;
+               if (*idx < s_idx)
+                       goto cont;
+               if (*idx > s_idx) {
+                       memset(&cb->args[1], 0,
+                                       sizeof(cb->args) - sizeof(cb->args[0]));
+               }
+               if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
+                                       cb->nlh->nlmsg_seq,
+                                       NFT_MSG_NEWRULE,
+                                       NLM_F_MULTI | NLM_F_APPEND,
+                                       table->family,
+                                       table, chain, rule) < 0)
+                       goto out_unfinished;
+
+               nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+cont:
+               (*idx)++;
+       }
+       rc = 0;
+out_unfinished:
+       cb->args[0] = *idx;
+       return rc;
+}
+
 static int nf_tables_dump_rules(struct sk_buff *skb,
                                struct netlink_callback *cb)
 {
        const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
        const struct nft_rule_dump_ctx *ctx = cb->data;
-       const struct nft_table *table;
+       struct nft_table *table;
        const struct nft_chain *chain;
-       const struct nft_rule *rule;
-       unsigned int idx = 0, s_idx = cb->args[0];
+       unsigned int idx = 0;
        struct net *net = sock_net(skb->sk);
        int family = nfmsg->nfgen_family;
 
@@ -2313,37 +2354,34 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
                if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
                        continue;
 
-               list_for_each_entry_rcu(chain, &table->chains, list) {
-                       if (ctx && ctx->chain &&
-                           strcmp(ctx->chain, chain->name) != 0)
-                               continue;
+               if (ctx && ctx->chain) {
+                       struct rhlist_head *list, *tmp;
 
-                       list_for_each_entry_rcu(rule, &chain->rules, list) {
-                               if (!nft_is_active(net, rule))
-                                       goto cont;
-                               if (idx < s_idx)
-                                       goto cont;
-                               if (idx > s_idx)
-                                       memset(&cb->args[1], 0,
-                                              sizeof(cb->args) - sizeof(cb->args[0]));
-                               if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
-                                                             cb->nlh->nlmsg_seq,
-                                                             NFT_MSG_NEWRULE,
-                                                             NLM_F_MULTI | NLM_F_APPEND,
-                                                             table->family,
-                                                             table, chain, rule) < 0)
-                                       goto done;
-
-                               nl_dump_check_consistent(cb, nlmsg_hdr(skb));
-cont:
-                               idx++;
+                       list = rhltable_lookup(&table->chains_ht, ctx->chain,
+                                              nft_chain_ht_params);
+                       if (!list)
+                               goto done;
+
+                       rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
+                               if (!nft_is_active(net, chain))
+                                       continue;
+                               __nf_tables_dump_rules(skb, &idx,
+                                                      cb, table, chain);
+                               break;
                        }
+                       goto done;
+               }
+
+               list_for_each_entry_rcu(chain, &table->chains, list) {
+                       if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
+                               goto done;
                }
+
+               if (ctx && ctx->table)
+                       break;
        }
 done:
        rcu_read_unlock();
-
-       cb->args[0] = idx;
        return skb->len;
 }
 
@@ -6180,7 +6218,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
                return;
 
        basechain = nft_base_chain(trans->ctx.chain);
-       nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
+       nft_chain_stats_replace(trans->ctx.net, basechain,
+                               nft_trans_chain_stats(trans));
 
        switch (nft_trans_chain_policy(trans)) {
        case NF_DROP: