Skip to content

L
linux
Commit 0559518b authored by Jan Engelhardt's avatar Jan Engelhardt Committed by Patrick McHardy
Browse files
Options

netfilter: xtables: optimize call flow around xt_entry_foreach 

Signed-off-by: default avatarJan Engelhardt <jengelh@medozas.de>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 72b2b1dd
Hide whitespace changes
Inline Side-by-side
Showing with 182 additions and 360 deletions
net/ipv4/netfilter/arp_tables.c
View file @ 0559518b
...@@ -512,8 +512,7 @@ static inline int check_target(struct arpt_entry *e, const char *name) ...@@ -512,8 +512,7 @@ static inline int check_target(struct arpt_entry *e, const char *name)
} }
static inline int static inline int
find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
unsigned int *i)
{ {
struct arpt_entry_target *t; struct arpt_entry_target *t;
struct xt_target *target; struct xt_target *target;
...@@ -538,8 +537,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, ...@@ -538,8 +537,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
ret = check_target(e, name); ret = check_target(e, name);
if (ret) if (ret)
goto err; goto err;
(*i)++;
return 0; return 0;
err: err:
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
...@@ -568,8 +565,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, ...@@ -568,8 +565,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks, unsigned int valid_hooks)
unsigned int *i)
{ {
unsigned int h; unsigned int h;
...@@ -606,19 +602,14 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, ...@@ -606,19 +602,14 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
} }
static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i) static inline void cleanup_entry(struct arpt_entry *e)
{ {
struct xt_tgdtor_param par; struct xt_tgdtor_param par;
struct arpt_entry_target *t; struct arpt_entry_target *t;
if (i && (*i)-- == 0)
return 1;
t = arpt_get_target(e); t = arpt_get_target(e);
par.target = t->u.kernel.target; par.target = t->u.kernel.target;
par.targinfo = t->data; par.targinfo = t->data;
...@@ -626,7 +617,6 @@ static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i) ...@@ -626,7 +617,6 @@ static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
if (par.target->destroy != NULL) if (par.target->destroy != NULL)
par.target->destroy(&par); par.target->destroy(&par);
module_put(par.target->me); module_put(par.target->me);
return 0;
} }
/* Checks and translates the user-supplied table segment (held in /* Checks and translates the user-supplied table segment (held in
...@@ -660,10 +650,10 @@ static int translate_table(const char *name, ...@@ -660,10 +650,10 @@ static int translate_table(const char *name,
/* Walk through entries, checking offsets. */ /* Walk through entries, checking offsets. */
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = check_entry_size_and_hooks(iter, newinfo, entry0, ret = check_entry_size_and_hooks(iter, newinfo, entry0,
entry0 + size, hook_entries, underflows, entry0 + size, hook_entries, underflows, valid_hooks);
valid_hooks, &i);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret); duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
if (ret != 0) if (ret != 0)
...@@ -700,15 +690,18 @@ static int translate_table(const char *name, ...@@ -700,15 +690,18 @@ static int translate_table(const char *name,
/* Finally, each sanity check must pass */ /* Finally, each sanity check must pass */
i = 0; i = 0;
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = find_check_entry(iter, name, size, &i); ret = find_check_entry(iter, name, size);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret != 0) { if (ret != 0) {
xt_entry_foreach(iter, entry0, newinfo->size) xt_entry_foreach(iter, entry0, newinfo->size) {
if (cleanup_entry(iter, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter);
}
return ret; return ret;
} }
...@@ -721,27 +714,6 @@ static int translate_table(const char *name, ...@@ -721,27 +714,6 @@ static int translate_table(const char *name,
return ret; return ret;
} }
/* Gets counters. */
static inline int add_entry_to_counter(const struct arpt_entry *e,
struct xt_counters total[],
unsigned int *i)
{
ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static inline int set_entry_to_counter(const struct arpt_entry *e,
struct xt_counters total[],
unsigned int *i)
{
SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static void get_counters(const struct xt_table_info *t, static void get_counters(const struct xt_table_info *t,
struct xt_counters counters[]) struct xt_counters counters[])
{ {
...@@ -761,18 +733,22 @@ static void get_counters(const struct xt_table_info *t, ...@@ -761,18 +733,22 @@ static void get_counters(const struct xt_table_info *t,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
i = 0; i = 0;
xt_entry_foreach(iter, t->entries[curcpu], t->size) xt_entry_foreach(iter, t->entries[curcpu], t->size) {
if (set_entry_to_counter(iter, counters, &i) != 0) SET_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i;
}
for_each_possible_cpu(cpu) { for_each_possible_cpu(cpu) {
if (cpu == curcpu) if (cpu == curcpu)
continue; continue;
i = 0; i = 0;
xt_info_wrlock(cpu); xt_info_wrlock(cpu);
xt_entry_foreach(iter, t->entries[cpu], t->size) xt_entry_foreach(iter, t->entries[cpu], t->size) {
if (add_entry_to_counter(iter, counters, &i) != 0) ADD_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i;
}
xt_info_wrunlock(cpu); xt_info_wrunlock(cpu);
} }
local_bh_enable(); local_bh_enable();
...@@ -904,7 +880,7 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -904,7 +880,7 @@ static int compat_table_info(const struct xt_table_info *info,
{ {
struct arpt_entry *iter; struct arpt_entry *iter;
void *loc_cpu_entry; void *loc_cpu_entry;
int ret = 0; int ret;
if (!newinfo || !info) if (!newinfo || !info)
return -EINVAL; return -EINVAL;
...@@ -916,9 +892,9 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -916,9 +892,9 @@ static int compat_table_info(const struct xt_table_info *info,
xt_entry_foreach(iter, loc_cpu_entry, info->size) { xt_entry_foreach(iter, loc_cpu_entry, info->size) {
ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
if (ret != 0) if (ret != 0)
break; return ret;
} }
return ret; return 0;
} }
#endif #endif
...@@ -1078,8 +1054,7 @@ static int __do_replace(struct net *net, const char *name, ...@@ -1078,8 +1054,7 @@ static int __do_replace(struct net *net, const char *name,
/* Decrease module usage counts and free resource */ /* Decrease module usage counts and free resource */
loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()]; loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size) xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
if (cleanup_entry(iter, NULL) != 0) cleanup_entry(iter);
break;
xt_free_table_info(oldinfo); xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters, if (copy_to_user(counters_ptr, counters,
...@@ -1142,26 +1117,12 @@ static int do_replace(struct net *net, const void __user *user, ...@@ -1142,26 +1117,12 @@ static int do_replace(struct net *net, const void __user *user,
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, NULL) != 0) cleanup_entry(iter);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
/* We're lazy, and add to the first CPU; overflow works its fey magic
* and everything is OK. */
static int
add_counter_to_entry(struct arpt_entry *e,
const struct xt_counters addme[],
unsigned int *i)
{
ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
(*i)++;
return 0;
}
static int do_add_counters(struct net *net, const void __user *user, static int do_add_counters(struct net *net, const void __user *user,
unsigned int len, int compat) unsigned int len, int compat)
{ {
...@@ -1234,9 +1195,10 @@ static int do_add_counters(struct net *net, const void __user *user, ...@@ -1234,9 +1195,10 @@ static int do_add_counters(struct net *net, const void __user *user,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
loc_cpu_entry = private->entries[curcpu]; loc_cpu_entry = private->entries[curcpu];
xt_info_wrlock(curcpu); xt_info_wrlock(curcpu);
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size) {
if (add_counter_to_entry(iter, paddc, &i) != 0) ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
break; ++i;
}
xt_info_wrunlock(curcpu); xt_info_wrunlock(curcpu);
unlock_up_free: unlock_up_free:
local_bh_enable(); local_bh_enable();
...@@ -1249,17 +1211,12 @@ static int do_add_counters(struct net *net, const void __user *user, ...@@ -1249,17 +1211,12 @@ static int do_add_counters(struct net *net, const void __user *user,
} }
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
static inline int static inline void compat_release_entry(struct compat_arpt_entry *e)
compat_release_entry(struct compat_arpt_entry *e, unsigned int *i)
{ {
struct arpt_entry_target *t; struct arpt_entry_target *t;
if (i && (*i)-- == 0)
return 1;
t = compat_arpt_get_target(e); t = compat_arpt_get_target(e);
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
return 0;
} }
static inline int static inline int
...@@ -1270,7 +1227,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, ...@@ -1270,7 +1227,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int *i,
const char *name) const char *name)
{ {
struct arpt_entry_target *t; struct arpt_entry_target *t;
...@@ -1330,8 +1286,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, ...@@ -1330,8 +1286,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
memset(&e->counters, 0, sizeof(e->counters)); memset(&e->counters, 0, sizeof(e->counters));
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
release_target: release_target:
...@@ -1375,19 +1329,6 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, ...@@ -1375,19 +1329,6 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
return ret; return ret;
} }
static inline int compat_check_entry(struct arpt_entry *e, const char *name,
unsigned int *i)
{
int ret;
ret = check_target(e, name);
if (ret)
return ret;
(*i)++;
return 0;
}
static int translate_compat_table(const char *name, static int translate_compat_table(const char *name,
unsigned int valid_hooks, unsigned int valid_hooks,
struct xt_table_info **pinfo, struct xt_table_info **pinfo,
...@@ -1423,12 +1364,11 @@ static int translate_compat_table(const char *name, ...@@ -1423,12 +1364,11 @@ static int translate_compat_table(const char *name,
xt_entry_foreach(iter0, entry0, total_size) { xt_entry_foreach(iter0, entry0, total_size) {
ret = check_compat_entry_size_and_hooks(iter0, info, &size, ret = check_compat_entry_size_and_hooks(iter0, info, &size,
entry0, entry0 + total_size, hook_entries, underflows, entry0, entry0 + total_size, hook_entries, underflows,
&j, name); name);
if (ret != 0) if (ret != 0)
break; goto out_unlock;
++j;
} }
if (ret != 0)
goto out_unlock;
ret = -EINVAL; ret = -EINVAL;
if (j != number) { if (j != number) {
...@@ -1484,9 +1424,10 @@ static int translate_compat_table(const char *name, ...@@ -1484,9 +1424,10 @@ static int translate_compat_table(const char *name,
i = 0; i = 0;
xt_entry_foreach(iter1, entry1, newinfo->size) { xt_entry_foreach(iter1, entry1, newinfo->size) {
ret = compat_check_entry(iter1, name, &i); ret = check_target(iter1, name);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret) { if (ret) {
/* /*
...@@ -1499,12 +1440,15 @@ static int translate_compat_table(const char *name, ...@@ -1499,12 +1440,15 @@ static int translate_compat_table(const char *name,
xt_entry_foreach(iter0, entry0, newinfo->size) { xt_entry_foreach(iter0, entry0, newinfo->size) {
if (skip-- > 0) if (skip-- > 0)
continue; continue;
if (compat_release_entry(iter0, &j) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
} }
xt_entry_foreach(iter1, entry1, newinfo->size) xt_entry_foreach(iter1, entry1, newinfo->size) {
if (cleanup_entry(iter1, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter1);
}
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
...@@ -1522,9 +1466,11 @@ static int translate_compat_table(const char *name, ...@@ -1522,9 +1466,11 @@ static int translate_compat_table(const char *name,
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
out: out:
xt_entry_foreach(iter0, entry0, total_size) xt_entry_foreach(iter0, entry0, total_size) {
if (compat_release_entry(iter0, &j) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
}
return ret; return ret;
out_unlock: out_unlock:
xt_compat_flush_offsets(NFPROTO_ARP); xt_compat_flush_offsets(NFPROTO_ARP);
...@@ -1590,8 +1536,7 @@ static int compat_do_replace(struct net *net, void __user *user, ...@@ -1590,8 +1536,7 @@ static int compat_do_replace(struct net *net, void __user *user,
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, NULL) != 0) cleanup_entry(iter);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
...@@ -1625,7 +1570,7 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, ...@@ -1625,7 +1570,7 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,
static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr, static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
compat_uint_t *size, compat_uint_t *size,
struct xt_counters *counters, struct xt_counters *counters,
unsigned int *i) unsigned int i)
{ {
struct arpt_entry_target *t; struct arpt_entry_target *t;
struct compat_arpt_entry __user *ce; struct compat_arpt_entry __user *ce;
...@@ -1633,14 +1578,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr, ...@@ -1633,14 +1578,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
compat_uint_t origsize; compat_uint_t origsize;
int ret; int ret;
ret = -EFAULT;
origsize = *size; origsize = *size;
ce = (struct compat_arpt_entry __user *)*dstptr; ce = (struct compat_arpt_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct arpt_entry))) if (copy_to_user(ce, e, sizeof(struct arpt_entry)) != 0 ||
goto out; copy_to_user(&ce->counters, &counters[i],
sizeof(counters[i])) != 0)
if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i]))) return -EFAULT;
goto out;
*dstptr += sizeof(struct compat_arpt_entry); *dstptr += sizeof(struct compat_arpt_entry);
*size -= sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry); *size -= sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
...@@ -1650,18 +1593,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr, ...@@ -1650,18 +1593,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
t = arpt_get_target(e); t = arpt_get_target(e);
ret = xt_compat_target_to_user(t, dstptr, size); ret = xt_compat_target_to_user(t, dstptr, size);
if (ret) if (ret)
goto out; return ret;
ret = -EFAULT;
next_offset = e->next_offset - (origsize - *size); next_offset = e->next_offset - (origsize - *size);
if (put_user(target_offset, &ce->target_offset)) if (put_user(target_offset, &ce->target_offset) != 0 ||
goto out; put_user(next_offset, &ce->next_offset) != 0)
if (put_user(next_offset, &ce->next_offset)) return -EFAULT;
goto out;
(*i)++;
return 0; return 0;
out:
return ret;
} }
static int compat_copy_entries_to_user(unsigned int total_size, static int compat_copy_entries_to_user(unsigned int total_size,
...@@ -1687,7 +1624,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, ...@@ -1687,7 +1624,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
size = total_size; size = total_size;
xt_entry_foreach(iter, loc_cpu_entry, total_size) { xt_entry_foreach(iter, loc_cpu_entry, total_size) {
ret = compat_copy_entry_to_user(iter, &pos, ret = compat_copy_entry_to_user(iter, &pos,
&size, counters, &i); &size, counters, i++);
if (ret != 0) if (ret != 0)
break; break;
} }
...@@ -1893,8 +1830,7 @@ void arpt_unregister_table(struct xt_table *table) ...@@ -1893,8 +1830,7 @@ void arpt_unregister_table(struct xt_table *table)
/* Decrease module usage counts and free resources */ /* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries[raw_smp_processor_id()]; loc_cpu_entry = private->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size)
if (cleanup_entry(iter, NULL) != 0) cleanup_entry(iter);
break;
if (private->number > private->initial_entries) if (private->number > private->initial_entries)
module_put(table_owner); module_put(table_owner);
xt_free_table_info(private); xt_free_table_info(private);
......
net/ipv4/netfilter/ip_tables.c
View file @ 0559518b
...@@ -679,7 +679,7 @@ static int check_target(struct ipt_entry *e, struct net *net, const char *name) ...@@ -679,7 +679,7 @@ static int check_target(struct ipt_entry *e, struct net *net, const char *name)
static int static int
find_check_entry(struct ipt_entry *e, struct net *net, const char *name, find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
unsigned int size, unsigned int *i) unsigned int size)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
struct xt_target *target; struct xt_target *target;
...@@ -716,8 +716,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, ...@@ -716,8 +716,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
ret = check_target(e, net, name); ret = check_target(e, net, name);
if (ret) if (ret)
goto err; goto err;
(*i)++;
return 0; return 0;
err: err:
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
...@@ -748,8 +746,7 @@ check_entry_size_and_hooks(struct ipt_entry *e, ...@@ -748,8 +746,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks, unsigned int valid_hooks)
unsigned int *i)
{ {
unsigned int h; unsigned int h;
...@@ -786,20 +783,15 @@ check_entry_size_and_hooks(struct ipt_entry *e, ...@@ -786,20 +783,15 @@ check_entry_size_and_hooks(struct ipt_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
} }
static int static void
cleanup_entry(struct ipt_entry *e, struct net *net, unsigned int *i) cleanup_entry(struct ipt_entry *e, struct net *net)
{ {
struct xt_tgdtor_param par; struct xt_tgdtor_param par;
struct ipt_entry_target *t; struct ipt_entry_target *t;
if (i && (*i)-- == 0)
return 1;
/* Cleanup all matches */ /* Cleanup all matches */
IPT_MATCH_ITERATE(e, cleanup_match, net, NULL); IPT_MATCH_ITERATE(e, cleanup_match, net, NULL);
t = ipt_get_target(e); t = ipt_get_target(e);
...@@ -811,7 +803,6 @@ cleanup_entry(struct ipt_entry *e, struct net *net, unsigned int *i) ...@@ -811,7 +803,6 @@ cleanup_entry(struct ipt_entry *e, struct net *net, unsigned int *i)
if (par.target->destroy != NULL) if (par.target->destroy != NULL)
par.target->destroy(&par); par.target->destroy(&par);
module_put(par.target->me); module_put(par.target->me);
return 0;
} }
/* Checks and translates the user-supplied table segment (held in /* Checks and translates the user-supplied table segment (held in
...@@ -845,13 +836,11 @@ translate_table(struct net *net, ...@@ -845,13 +836,11 @@ translate_table(struct net *net,
/* Walk through entries, checking offsets. */ /* Walk through entries, checking offsets. */
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = check_entry_size_and_hooks(iter, newinfo, entry0, ret = check_entry_size_and_hooks(iter, newinfo, entry0,
entry0 + size, hook_entries, underflows, entry0 + size, hook_entries, underflows, valid_hooks);
valid_hooks, &i);
if (ret != 0) if (ret != 0)
break; return ret;
++i;
} }
if (ret != 0)
return ret;
if (i != number) { if (i != number) {
duprintf("translate_table: %u not %u entries\n", duprintf("translate_table: %u not %u entries\n",
...@@ -882,15 +871,18 @@ translate_table(struct net *net, ...@@ -882,15 +871,18 @@ translate_table(struct net *net,
/* Finally, each sanity check must pass */ /* Finally, each sanity check must pass */
i = 0; i = 0;
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = find_check_entry(iter, net, name, size, &i); ret = find_check_entry(iter, net, name, size);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret != 0) { if (ret != 0) {
xt_entry_foreach(iter, entry0, newinfo->size) xt_entry_foreach(iter, entry0, newinfo->size) {
if (cleanup_entry(iter, net, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter, net);
}
return ret; return ret;
} }
...@@ -903,29 +895,6 @@ translate_table(struct net *net, ...@@ -903,29 +895,6 @@ translate_table(struct net *net,
return ret; return ret;
} }
/* Gets counters. */
static inline int
add_entry_to_counter(const struct ipt_entry *e,
struct xt_counters total[],
unsigned int *i)
{
ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static inline int
set_entry_to_counter(const struct ipt_entry *e,
struct ipt_counters total[],
unsigned int *i)
{
SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static void static void
get_counters(const struct xt_table_info *t, get_counters(const struct xt_table_info *t,
struct xt_counters counters[]) struct xt_counters counters[])
...@@ -946,18 +915,22 @@ get_counters(const struct xt_table_info *t, ...@@ -946,18 +915,22 @@ get_counters(const struct xt_table_info *t,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
i = 0; i = 0;
xt_entry_foreach(iter, t->entries[curcpu], t->size) xt_entry_foreach(iter, t->entries[curcpu], t->size) {
if (set_entry_to_counter(iter, counters, &i) != 0) SET_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i;
}
for_each_possible_cpu(cpu) { for_each_possible_cpu(cpu) {
if (cpu == curcpu) if (cpu == curcpu)
continue; continue;
i = 0; i = 0;
xt_info_wrlock(cpu); xt_info_wrlock(cpu);
xt_entry_foreach(iter, t->entries[cpu], t->size) xt_entry_foreach(iter, t->entries[cpu], t->size) {
if (add_entry_to_counter(iter, counters, &i) != 0) ADD_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i; /* macro does multi eval of i */
}
xt_info_wrunlock(cpu); xt_info_wrunlock(cpu);
} }
local_bh_enable(); local_bh_enable();
...@@ -1117,7 +1090,7 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -1117,7 +1090,7 @@ static int compat_table_info(const struct xt_table_info *info,
{ {
struct ipt_entry *iter; struct ipt_entry *iter;
void *loc_cpu_entry; void *loc_cpu_entry;
int ret = 0; int ret;
if (!newinfo || !info) if (!newinfo || !info)
return -EINVAL; return -EINVAL;
...@@ -1129,9 +1102,9 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -1129,9 +1102,9 @@ static int compat_table_info(const struct xt_table_info *info,
xt_entry_foreach(iter, loc_cpu_entry, info->size) { xt_entry_foreach(iter, loc_cpu_entry, info->size) {
ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
if (ret != 0) if (ret != 0)
break; return ret;
} }
return ret; return 0;
} }
#endif #endif
...@@ -1289,8 +1262,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, ...@@ -1289,8 +1262,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
/* Decrease module usage counts and free resource */ /* Decrease module usage counts and free resource */
loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()]; loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size) xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
xt_free_table_info(oldinfo); xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters, if (copy_to_user(counters_ptr, counters,
...@@ -1353,26 +1325,12 @@ do_replace(struct net *net, const void __user *user, unsigned int len) ...@@ -1353,26 +1325,12 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
/* We're lazy, and add to the first CPU; overflow works its fey magic
* and everything is OK. */
static int
add_counter_to_entry(struct ipt_entry *e,
const struct xt_counters addme[],
unsigned int *i)
{
ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
(*i)++;
return 0;
}
static int static int
do_add_counters(struct net *net, const void __user *user, do_add_counters(struct net *net, const void __user *user,
unsigned int len, int compat) unsigned int len, int compat)
...@@ -1446,9 +1404,10 @@ do_add_counters(struct net *net, const void __user *user, ...@@ -1446,9 +1404,10 @@ do_add_counters(struct net *net, const void __user *user,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
loc_cpu_entry = private->entries[curcpu]; loc_cpu_entry = private->entries[curcpu];
xt_info_wrlock(curcpu); xt_info_wrlock(curcpu);
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size) {
if (add_counter_to_entry(iter, paddc, &i) != 0) ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
break; ++i;
}
xt_info_wrunlock(curcpu); xt_info_wrunlock(curcpu);
unlock_up_free: unlock_up_free:
local_bh_enable(); local_bh_enable();
...@@ -1476,7 +1435,7 @@ struct compat_ipt_replace { ...@@ -1476,7 +1435,7 @@ struct compat_ipt_replace {
static int static int
compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr, compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
unsigned int *size, struct xt_counters *counters, unsigned int *size, struct xt_counters *counters,
unsigned int *i) unsigned int i)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
struct compat_ipt_entry __user *ce; struct compat_ipt_entry __user *ce;
...@@ -1484,14 +1443,12 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr, ...@@ -1484,14 +1443,12 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
compat_uint_t origsize; compat_uint_t origsize;
int ret; int ret;
ret = -EFAULT;
origsize = *size; origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr; ce = (struct compat_ipt_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct ipt_entry))) if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
goto out; copy_to_user(&ce->counters, &counters[i],
sizeof(counters[i])) != 0)
if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i]))) return -EFAULT;
goto out;
*dstptr += sizeof(struct compat_ipt_entry); *dstptr += sizeof(struct compat_ipt_entry);
*size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry); *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
...@@ -1499,22 +1456,16 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr, ...@@ -1499,22 +1456,16 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size); ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
target_offset = e->target_offset - (origsize - *size); target_offset = e->target_offset - (origsize - *size);
if (ret) if (ret)
goto out; return ret;
t = ipt_get_target(e); t = ipt_get_target(e);
ret = xt_compat_target_to_user(t, dstptr, size); ret = xt_compat_target_to_user(t, dstptr, size);
if (ret) if (ret)
goto out; return ret;
ret = -EFAULT;
next_offset = e->next_offset - (origsize - *size); next_offset = e->next_offset - (origsize - *size);
if (put_user(target_offset, &ce->target_offset)) if (put_user(target_offset, &ce->target_offset) != 0 ||
goto out; put_user(next_offset, &ce->next_offset) != 0)
if (put_user(next_offset, &ce->next_offset)) return -EFAULT;
goto out;
(*i)++;
return 0; return 0;
out:
return ret;
} }
static int static int
...@@ -1551,19 +1502,14 @@ compat_release_match(struct ipt_entry_match *m, unsigned int *i) ...@@ -1551,19 +1502,14 @@ compat_release_match(struct ipt_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static int static void compat_release_entry(struct compat_ipt_entry *e)
compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
if (i && (*i)-- == 0)
return 1;
/* Cleanup all matches */ /* Cleanup all matches */
COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL); COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
t = compat_ipt_get_target(e); t = compat_ipt_get_target(e);
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
return 0;
} }
static int static int
...@@ -1574,7 +1520,6 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, ...@@ -1574,7 +1520,6 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int *i,
const char *name) const char *name)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
...@@ -1640,8 +1585,6 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, ...@@ -1640,8 +1585,6 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
memset(&e->counters, 0, sizeof(e->counters)); memset(&e->counters, 0, sizeof(e->counters));
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
out: out:
...@@ -1691,8 +1634,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr, ...@@ -1691,8 +1634,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
} }
static int static int
compat_check_entry(struct ipt_entry *e, struct net *net, const char *name, compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
unsigned int *i)
{ {
struct xt_mtchk_param mtpar; struct xt_mtchk_param mtpar;
unsigned int j; unsigned int j;
...@@ -1711,8 +1653,6 @@ compat_check_entry(struct ipt_entry *e, struct net *net, const char *name, ...@@ -1711,8 +1653,6 @@ compat_check_entry(struct ipt_entry *e, struct net *net, const char *name,
ret = check_target(e, net, name); ret = check_target(e, net, name);
if (ret) if (ret)
goto cleanup_matches; goto cleanup_matches;
(*i)++;
return 0; return 0;
cleanup_matches: cleanup_matches:
...@@ -1737,7 +1677,7 @@ translate_compat_table(struct net *net, ...@@ -1737,7 +1677,7 @@ translate_compat_table(struct net *net,
struct compat_ipt_entry *iter0; struct compat_ipt_entry *iter0;
struct ipt_entry *iter1; struct ipt_entry *iter1;
unsigned int size; unsigned int size;
int ret = 0; int ret;
info = *pinfo; info = *pinfo;
entry0 = *pentry0; entry0 = *pentry0;
...@@ -1757,12 +1697,11 @@ translate_compat_table(struct net *net, ...@@ -1757,12 +1697,11 @@ translate_compat_table(struct net *net,
xt_entry_foreach(iter0, entry0, total_size) { xt_entry_foreach(iter0, entry0, total_size) {
ret = check_compat_entry_size_and_hooks(iter0, info, &size, ret = check_compat_entry_size_and_hooks(iter0, info, &size,
entry0, entry0 + total_size, hook_entries, underflows, entry0, entry0 + total_size, hook_entries, underflows,
&j, name); name);
if (ret != 0) if (ret != 0)
break; goto out_unlock;
++j;
} }
if (ret != 0)
goto out_unlock;
ret = -EINVAL; ret = -EINVAL;
if (j != number) { if (j != number) {
...@@ -1818,9 +1757,10 @@ translate_compat_table(struct net *net, ...@@ -1818,9 +1757,10 @@ translate_compat_table(struct net *net,
i = 0; i = 0;
xt_entry_foreach(iter1, entry1, newinfo->size) { xt_entry_foreach(iter1, entry1, newinfo->size) {
ret = compat_check_entry(iter1, net, name, &i); ret = compat_check_entry(iter1, net, name);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret) { if (ret) {
/* /*
...@@ -1833,12 +1773,15 @@ translate_compat_table(struct net *net, ...@@ -1833,12 +1773,15 @@ translate_compat_table(struct net *net,
xt_entry_foreach(iter0, entry0, newinfo->size) { xt_entry_foreach(iter0, entry0, newinfo->size) {
if (skip-- > 0) if (skip-- > 0)
continue; continue;
if (compat_release_entry(iter0, &i) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
} }
xt_entry_foreach(iter1, entry1, newinfo->size) xt_entry_foreach(iter1, entry1, newinfo->size) {
if (cleanup_entry(iter1, net, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter1, net);
}
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
...@@ -1856,9 +1799,11 @@ translate_compat_table(struct net *net, ...@@ -1856,9 +1799,11 @@ translate_compat_table(struct net *net,
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
out: out:
xt_entry_foreach(iter0, entry0, total_size) xt_entry_foreach(iter0, entry0, total_size) {
if (compat_release_entry(iter0, &j) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
}
return ret; return ret;
out_unlock: out_unlock:
xt_compat_flush_offsets(AF_INET); xt_compat_flush_offsets(AF_INET);
...@@ -1913,8 +1858,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len) ...@@ -1913,8 +1858,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
...@@ -1978,7 +1922,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, ...@@ -1978,7 +1922,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
size = total_size; size = total_size;
xt_entry_foreach(iter, loc_cpu_entry, total_size) { xt_entry_foreach(iter, loc_cpu_entry, total_size) {
ret = compat_copy_entry_to_user(iter, &pos, ret = compat_copy_entry_to_user(iter, &pos,
&size, counters, &i); &size, counters, i++);
if (ret != 0) if (ret != 0)
break; break;
} }
...@@ -2189,8 +2133,7 @@ void ipt_unregister_table(struct net *net, struct xt_table *table) ...@@ -2189,8 +2133,7 @@ void ipt_unregister_table(struct net *net, struct xt_table *table)
/* Decrease module usage counts and free resources */ /* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries[raw_smp_processor_id()]; loc_cpu_entry = private->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
if (private->number > private->initial_entries) if (private->number > private->initial_entries)
module_put(table_owner); module_put(table_owner);
xt_free_table_info(private); xt_free_table_info(private);
......
net/ipv6/netfilter/ip6_tables.c
View file @ 0559518b
...@@ -710,7 +710,7 @@ static int check_target(struct ip6t_entry *e, struct net *net, const char *name) ...@@ -710,7 +710,7 @@ static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
static int static int
find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
unsigned int size, unsigned int *i) unsigned int size)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
struct xt_target *target; struct xt_target *target;
...@@ -747,8 +747,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, ...@@ -747,8 +747,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
ret = check_target(e, net, name); ret = check_target(e, net, name);
if (ret) if (ret)
goto err; goto err;
(*i)++;
return 0; return 0;
err: err:
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
...@@ -779,8 +777,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e, ...@@ -779,8 +777,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int valid_hooks, unsigned int valid_hooks)
unsigned int *i)
{ {
unsigned int h; unsigned int h;
...@@ -817,20 +814,14 @@ check_entry_size_and_hooks(struct ip6t_entry *e, ...@@ -817,20 +814,14 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
e->counters = ((struct xt_counters) { 0, 0 }); e->counters = ((struct xt_counters) { 0, 0 });
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
} }
static int static void cleanup_entry(struct ip6t_entry *e, struct net *net)
cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i)
{ {
struct xt_tgdtor_param par; struct xt_tgdtor_param par;
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
if (i && (*i)-- == 0)
return 1;
/* Cleanup all matches */ /* Cleanup all matches */
IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL); IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL);
t = ip6t_get_target(e); t = ip6t_get_target(e);
...@@ -842,7 +833,6 @@ cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i) ...@@ -842,7 +833,6 @@ cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i)
if (par.target->destroy != NULL) if (par.target->destroy != NULL)
par.target->destroy(&par); par.target->destroy(&par);
module_put(par.target->me); module_put(par.target->me);
return 0;
} }
/* Checks and translates the user-supplied table segment (held in /* Checks and translates the user-supplied table segment (held in
...@@ -876,13 +866,11 @@ translate_table(struct net *net, ...@@ -876,13 +866,11 @@ translate_table(struct net *net,
/* Walk through entries, checking offsets. */ /* Walk through entries, checking offsets. */
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = check_entry_size_and_hooks(iter, newinfo, entry0, ret = check_entry_size_and_hooks(iter, newinfo, entry0,
entry0 + size, hook_entries, underflows, entry0 + size, hook_entries, underflows, valid_hooks);
valid_hooks, &i);
if (ret != 0) if (ret != 0)
break; return ret;
++i;
} }
if (ret != 0)
return ret;
if (i != number) { if (i != number) {
duprintf("translate_table: %u not %u entries\n", duprintf("translate_table: %u not %u entries\n",
...@@ -913,15 +901,18 @@ translate_table(struct net *net, ...@@ -913,15 +901,18 @@ translate_table(struct net *net,
/* Finally, each sanity check must pass */ /* Finally, each sanity check must pass */
i = 0; i = 0;
xt_entry_foreach(iter, entry0, newinfo->size) { xt_entry_foreach(iter, entry0, newinfo->size) {
ret = find_check_entry(iter, net, name, size, &i); ret = find_check_entry(iter, net, name, size);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret != 0) { if (ret != 0) {
xt_entry_foreach(iter, entry0, newinfo->size) xt_entry_foreach(iter, entry0, newinfo->size) {
if (cleanup_entry(iter, net, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter, net);
}
return ret; return ret;
} }
...@@ -934,29 +925,6 @@ translate_table(struct net *net, ...@@ -934,29 +925,6 @@ translate_table(struct net *net,
return ret; return ret;
} }
/* Gets counters. */
static inline int
add_entry_to_counter(const struct ip6t_entry *e,
struct xt_counters total[],
unsigned int *i)
{
ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static inline int
set_entry_to_counter(const struct ip6t_entry *e,
struct ip6t_counters total[],
unsigned int *i)
{
SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
(*i)++;
return 0;
}
static void static void
get_counters(const struct xt_table_info *t, get_counters(const struct xt_table_info *t,
struct xt_counters counters[]) struct xt_counters counters[])
...@@ -977,18 +945,22 @@ get_counters(const struct xt_table_info *t, ...@@ -977,18 +945,22 @@ get_counters(const struct xt_table_info *t,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
i = 0; i = 0;
xt_entry_foreach(iter, t->entries[curcpu], t->size) xt_entry_foreach(iter, t->entries[curcpu], t->size) {
if (set_entry_to_counter(iter, counters, &i) != 0) SET_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i;
}
for_each_possible_cpu(cpu) { for_each_possible_cpu(cpu) {
if (cpu == curcpu) if (cpu == curcpu)
continue; continue;
i = 0; i = 0;
xt_info_wrlock(cpu); xt_info_wrlock(cpu);
xt_entry_foreach(iter, t->entries[cpu], t->size) xt_entry_foreach(iter, t->entries[cpu], t->size) {
if (add_entry_to_counter(iter, counters, &i) != 0) ADD_COUNTER(counters[i], iter->counters.bcnt,
break; iter->counters.pcnt);
++i;
}
xt_info_wrunlock(cpu); xt_info_wrunlock(cpu);
} }
local_bh_enable(); local_bh_enable();
...@@ -1148,7 +1120,7 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -1148,7 +1120,7 @@ static int compat_table_info(const struct xt_table_info *info,
{ {
struct ip6t_entry *iter; struct ip6t_entry *iter;
void *loc_cpu_entry; void *loc_cpu_entry;
int ret = 0; int ret;
if (!newinfo || !info) if (!newinfo || !info)
return -EINVAL; return -EINVAL;
...@@ -1160,9 +1132,9 @@ static int compat_table_info(const struct xt_table_info *info, ...@@ -1160,9 +1132,9 @@ static int compat_table_info(const struct xt_table_info *info,
xt_entry_foreach(iter, loc_cpu_entry, info->size) { xt_entry_foreach(iter, loc_cpu_entry, info->size) {
ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
if (ret != 0) if (ret != 0)
break; return ret;
} }
return ret; return 0;
} }
#endif #endif
...@@ -1321,8 +1293,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, ...@@ -1321,8 +1293,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
/* Decrease module usage counts and free resource */ /* Decrease module usage counts and free resource */
loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()]; loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size) xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
xt_free_table_info(oldinfo); xt_free_table_info(oldinfo);
if (copy_to_user(counters_ptr, counters, if (copy_to_user(counters_ptr, counters,
...@@ -1385,26 +1356,12 @@ do_replace(struct net *net, const void __user *user, unsigned int len) ...@@ -1385,26 +1356,12 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
/* We're lazy, and add to the first CPU; overflow works its fey magic
* and everything is OK. */
static int
add_counter_to_entry(struct ip6t_entry *e,
const struct xt_counters addme[],
unsigned int *i)
{
ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
(*i)++;
return 0;
}
static int static int
do_add_counters(struct net *net, const void __user *user, unsigned int len, do_add_counters(struct net *net, const void __user *user, unsigned int len,
int compat) int compat)
...@@ -1479,9 +1436,10 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len, ...@@ -1479,9 +1436,10 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
curcpu = smp_processor_id(); curcpu = smp_processor_id();
xt_info_wrlock(curcpu); xt_info_wrlock(curcpu);
loc_cpu_entry = private->entries[curcpu]; loc_cpu_entry = private->entries[curcpu];
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size) {
if (add_counter_to_entry(iter, paddc, &i) != 0) ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
break; ++i;
}
xt_info_wrunlock(curcpu); xt_info_wrunlock(curcpu);
unlock_up_free: unlock_up_free:
...@@ -1510,7 +1468,7 @@ struct compat_ip6t_replace { ...@@ -1510,7 +1468,7 @@ struct compat_ip6t_replace {
static int static int
compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr, compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
unsigned int *size, struct xt_counters *counters, unsigned int *size, struct xt_counters *counters,
unsigned int *i) unsigned int i)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
struct compat_ip6t_entry __user *ce; struct compat_ip6t_entry __user *ce;
...@@ -1518,14 +1476,12 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr, ...@@ -1518,14 +1476,12 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
compat_uint_t origsize; compat_uint_t origsize;
int ret; int ret;
ret = -EFAULT;
origsize = *size; origsize = *size;
ce = (struct compat_ip6t_entry __user *)*dstptr; ce = (struct compat_ip6t_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct ip6t_entry))) if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
goto out; copy_to_user(&ce->counters, &counters[i],
sizeof(counters[i])) != 0)
if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i]))) return -EFAULT;
goto out;
*dstptr += sizeof(struct compat_ip6t_entry); *dstptr += sizeof(struct compat_ip6t_entry);
*size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry); *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
...@@ -1533,22 +1489,16 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr, ...@@ -1533,22 +1489,16 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size); ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
target_offset = e->target_offset - (origsize - *size); target_offset = e->target_offset - (origsize - *size);
if (ret) if (ret)
goto out; return ret;
t = ip6t_get_target(e); t = ip6t_get_target(e);
ret = xt_compat_target_to_user(t, dstptr, size); ret = xt_compat_target_to_user(t, dstptr, size);
if (ret) if (ret)
goto out; return ret;
ret = -EFAULT;
next_offset = e->next_offset - (origsize - *size); next_offset = e->next_offset - (origsize - *size);
if (put_user(target_offset, &ce->target_offset)) if (put_user(target_offset, &ce->target_offset) != 0 ||
goto out; put_user(next_offset, &ce->next_offset) != 0)
if (put_user(next_offset, &ce->next_offset)) return -EFAULT;
goto out;
(*i)++;
return 0; return 0;
out:
return ret;
} }
static int static int
...@@ -1585,19 +1535,14 @@ compat_release_match(struct ip6t_entry_match *m, unsigned int *i) ...@@ -1585,19 +1535,14 @@ compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static int static void compat_release_entry(struct compat_ip6t_entry *e)
compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
if (i && (*i)-- == 0)
return 1;
/* Cleanup all matches */ /* Cleanup all matches */
COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL); COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
t = compat_ip6t_get_target(e); t = compat_ip6t_get_target(e);
module_put(t->u.kernel.target->me); module_put(t->u.kernel.target->me);
return 0;
} }
static int static int
...@@ -1608,7 +1553,6 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, ...@@ -1608,7 +1553,6 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
const unsigned char *limit, const unsigned char *limit,
const unsigned int *hook_entries, const unsigned int *hook_entries,
const unsigned int *underflows, const unsigned int *underflows,
unsigned int *i,
const char *name) const char *name)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
...@@ -1674,8 +1618,6 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, ...@@ -1674,8 +1618,6 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
/* Clear counters and comefrom */ /* Clear counters and comefrom */
memset(&e->counters, 0, sizeof(e->counters)); memset(&e->counters, 0, sizeof(e->counters));
e->comefrom = 0; e->comefrom = 0;
(*i)++;
return 0; return 0;
out: out:
...@@ -1725,7 +1667,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr, ...@@ -1725,7 +1667,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
} }
static int compat_check_entry(struct ip6t_entry *e, struct net *net, static int compat_check_entry(struct ip6t_entry *e, struct net *net,
const char *name, unsigned int *i) const char *name)
{ {
unsigned int j; unsigned int j;
int ret; int ret;
...@@ -1744,8 +1686,6 @@ static int compat_check_entry(struct ip6t_entry *e, struct net *net, ...@@ -1744,8 +1686,6 @@ static int compat_check_entry(struct ip6t_entry *e, struct net *net,
ret = check_target(e, net, name); ret = check_target(e, net, name);
if (ret) if (ret)
goto cleanup_matches; goto cleanup_matches;
(*i)++;
return 0; return 0;
cleanup_matches: cleanup_matches:
...@@ -1790,12 +1730,11 @@ translate_compat_table(struct net *net, ...@@ -1790,12 +1730,11 @@ translate_compat_table(struct net *net,
xt_entry_foreach(iter0, entry0, total_size) { xt_entry_foreach(iter0, entry0, total_size) {
ret = check_compat_entry_size_and_hooks(iter0, info, &size, ret = check_compat_entry_size_and_hooks(iter0, info, &size,
entry0, entry0 + total_size, hook_entries, underflows, entry0, entry0 + total_size, hook_entries, underflows,
&j, name); name);
if (ret != 0) if (ret != 0)
break; goto out_unlock;
++j;
} }
if (ret != 0)
goto out_unlock;
ret = -EINVAL; ret = -EINVAL;
if (j != number) { if (j != number) {
...@@ -1851,9 +1790,10 @@ translate_compat_table(struct net *net, ...@@ -1851,9 +1790,10 @@ translate_compat_table(struct net *net,
i = 0; i = 0;
xt_entry_foreach(iter1, entry1, newinfo->size) { xt_entry_foreach(iter1, entry1, newinfo->size) {
ret = compat_check_entry(iter1, net, name, &i); ret = compat_check_entry(iter1, net, name);
if (ret != 0) if (ret != 0)
break; break;
++i;
} }
if (ret) { if (ret) {
/* /*
...@@ -1866,12 +1806,15 @@ translate_compat_table(struct net *net, ...@@ -1866,12 +1806,15 @@ translate_compat_table(struct net *net,
xt_entry_foreach(iter0, entry0, newinfo->size) { xt_entry_foreach(iter0, entry0, newinfo->size) {
if (skip-- > 0) if (skip-- > 0)
continue; continue;
if (compat_release_entry(iter0, &j) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
} }
xt_entry_foreach(iter1, entry1, newinfo->size) xt_entry_foreach(iter1, entry1, newinfo->size) {
if (cleanup_entry(iter1, net, &i) != 0) if (i-- == 0)
break; break;
cleanup_entry(iter1, net);
}
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
} }
...@@ -1889,9 +1832,11 @@ translate_compat_table(struct net *net, ...@@ -1889,9 +1832,11 @@ translate_compat_table(struct net *net,
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
out: out:
xt_entry_foreach(iter0, entry0, total_size) xt_entry_foreach(iter0, entry0, total_size) {
if (compat_release_entry(iter0, &j) != 0) if (j-- == 0)
break; break;
compat_release_entry(iter0);
}
return ret; return ret;
out_unlock: out_unlock:
xt_compat_flush_offsets(AF_INET6); xt_compat_flush_offsets(AF_INET6);
...@@ -1946,8 +1891,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len) ...@@ -1946,8 +1891,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
free_newinfo_untrans: free_newinfo_untrans:
xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
free_newinfo: free_newinfo:
xt_free_table_info(newinfo); xt_free_table_info(newinfo);
return ret; return ret;
...@@ -2011,7 +1955,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, ...@@ -2011,7 +1955,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
size = total_size; size = total_size;
xt_entry_foreach(iter, loc_cpu_entry, total_size) { xt_entry_foreach(iter, loc_cpu_entry, total_size) {
ret = compat_copy_entry_to_user(iter, &pos, ret = compat_copy_entry_to_user(iter, &pos,
&size, counters, &i); &size, counters, i++);
if (ret != 0) if (ret != 0)
break; break;
} }
...@@ -2221,8 +2165,7 @@ void ip6t_unregister_table(struct net *net, struct xt_table *table) ...@@ -2221,8 +2165,7 @@ void ip6t_unregister_table(struct net *net, struct xt_table *table)
/* Decrease module usage counts and free resources */ /* Decrease module usage counts and free resources */
loc_cpu_entry = private->entries[raw_smp_processor_id()]; loc_cpu_entry = private->entries[raw_smp_processor_id()];
xt_entry_foreach(iter, loc_cpu_entry, private->size) xt_entry_foreach(iter, loc_cpu_entry, private->size)
if (cleanup_entry(iter, net, NULL) != 0) cleanup_entry(iter, net);
break;
if (private->number > private->initial_entries) if (private->number > private->initial_entries)
module_put(table_owner); module_put(table_owner);
xt_free_table_info(private); xt_free_table_info(private);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7