lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1282027297-9998-1-git-send-email-xiaosuo@gmail.com>
Date:	Tue, 17 Aug 2010 14:41:37 +0800
From:	Changli Gao <xiaosuo@...il.com>
To:	Patrick McHardy <kaber@...sh.net>
Cc:	"David S. Miller" <davem@...emloft.net>,
	netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
	Changli Gao <xiaosuo@...il.com>
Subject: [PATCH] netfilter: don't disable BH again in BH disabled context

All the matches and targets of iptables, ip6tables are in BH disabled
context, since xt_info_rdlock_bh() disables BH.

Signed-off-by: Changli Gao <xiaosuo@...il.com>
---
 net/ipv4/netfilter/ipt_LOG.c  |    8 ++++----
 net/ipv4/netfilter/ipt_ULOG.c |    6 +++---
 net/ipv6/netfilter/ip6t_LOG.c |    8 ++++----
 net/netfilter/xt_RATEEST.c    |    4 ++--
 net/netfilter/xt_connlimit.c  |    4 ++--
 net/netfilter/xt_dccp.c       |    8 ++++----
 net/netfilter/xt_limit.c      |    6 +++---
 net/netfilter/xt_quota.c      |    4 ++--
 net/netfilter/xt_rateest.c    |    8 ++++----
 net/netfilter/xt_recent.c     |    4 ++--
 10 files changed, 30 insertions(+), 30 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 915fc17..3ea7cfa 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -337,12 +337,12 @@ static void dump_packet(const struct nf_loginfo *info,
 
 	/* Max length: 15 "UID=4294967295 " */
 	if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
-		read_lock_bh(&skb->sk->sk_callback_lock);
+		read_lock(&skb->sk->sk_callback_lock);
 		if (skb->sk->sk_socket && skb->sk->sk_socket->file)
 			printk("UID=%u GID=%u ",
 				skb->sk->sk_socket->file->f_cred->fsuid,
 				skb->sk->sk_socket->file->f_cred->fsgid);
-		read_unlock_bh(&skb->sk->sk_callback_lock);
+		read_unlock(&skb->sk->sk_callback_lock);
 	}
 
 	/* Max length: 16 "MARK=0xFFFFFFFF " */
@@ -422,7 +422,7 @@ ipt_log_packet(u_int8_t pf,
 	if (!loginfo)
 		loginfo = &default_loginfo;
 
-	spin_lock_bh(&log_lock);
+	spin_lock(&log_lock);
 	printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
 	       prefix,
 	       in ? in->name : "",
@@ -447,7 +447,7 @@ ipt_log_packet(u_int8_t pf,
 
 	dump_packet(loginfo, skb, 0);
 	printk("\n");
-	spin_unlock_bh(&log_lock);
+	spin_unlock(&log_lock);
 }
 
 static unsigned int
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 446e0f4..f2dd9eb 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -180,7 +180,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
 
 	ub = &ulog_buffers[groupnum];
 
-	spin_lock_bh(&ulog_lock);
+	spin_lock(&ulog_lock);
 
 	if (!ub->skb) {
 		if (!(ub->skb = ulog_alloc_skb(size)))
@@ -264,7 +264,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
 		ulog_send(groupnum);
 	}
 
-	spin_unlock_bh(&ulog_lock);
+	spin_unlock(&ulog_lock);
 
 	return;
 
@@ -272,7 +272,7 @@ nlmsg_failure:
 	pr_debug("error during NLMSG_PUT\n");
 alloc_failure:
 	pr_debug("Error building netlink message\n");
-	spin_unlock_bh(&ulog_lock);
+	spin_unlock(&ulog_lock);
 }
 
 static unsigned int
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 0a07ae7..c517239 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -360,12 +360,12 @@ static void dump_packet(const struct nf_loginfo *info,
 
 	/* Max length: 15 "UID=4294967295 " */
 	if ((logflags & IP6T_LOG_UID) && recurse && skb->sk) {
-		read_lock_bh(&skb->sk->sk_callback_lock);
+		read_lock(&skb->sk->sk_callback_lock);
 		if (skb->sk->sk_socket && skb->sk->sk_socket->file)
 			printk("UID=%u GID=%u ",
 				skb->sk->sk_socket->file->f_cred->fsuid,
 				skb->sk->sk_socket->file->f_cred->fsgid);
-		read_unlock_bh(&skb->sk->sk_callback_lock);
+		read_unlock(&skb->sk->sk_callback_lock);
 	}
 
 	/* Max length: 16 "MARK=0xFFFFFFFF " */
@@ -445,7 +445,7 @@ ip6t_log_packet(u_int8_t pf,
 	if (!loginfo)
 		loginfo = &default_loginfo;
 
-	spin_lock_bh(&log_lock);
+	spin_lock(&log_lock);
 	printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
 		prefix,
 		in ? in->name : "",
@@ -457,7 +457,7 @@ ip6t_log_packet(u_int8_t pf,
 
 	dump_packet(loginfo, skb, skb_network_offset(skb), 1);
 	printk("\n");
-	spin_unlock_bh(&log_lock);
+	spin_unlock(&log_lock);
 }
 
 static unsigned int
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index de079ab..74a602b 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -87,10 +87,10 @@ xt_rateest_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	const struct xt_rateest_target_info *info = par->targinfo;
 	struct gnet_stats_basic_packed *stats = &info->est->bstats;
 
-	spin_lock_bh(&info->est->lock);
+	spin_lock(&info->est->lock);
 	stats->bytes += skb->len;
 	stats->packets++;
-	spin_unlock_bh(&info->est->lock);
+	spin_unlock(&info->est->lock);
 
 	return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 5c5b6b9..6851b98 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -199,10 +199,10 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		addr.ip = iph->saddr;
 	}
 
-	spin_lock_bh(&info->data->lock);
+	spin_lock(&info->data->lock);
 	connections = count_them(net, info->data, tuple_ptr, &addr,
 	                         &info->mask, par->family);
-	spin_unlock_bh(&info->data->lock);
+	spin_unlock(&info->data->lock);
 
 	if (connections < 0) {
 		/* kmalloc failed, drop it entirely */
diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c
index b63d2a3..3472f97 100644
--- a/net/netfilter/xt_dccp.c
+++ b/net/netfilter/xt_dccp.c
@@ -52,7 +52,7 @@ dccp_find_option(u_int8_t option,
 	if (!optlen)
 		return false;
 
-	spin_lock_bh(&dccp_buflock);
+	spin_lock(&dccp_buflock);
 	op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
 	if (op == NULL) {
 		/* If we don't have the whole header, drop packet. */
@@ -61,7 +61,7 @@ dccp_find_option(u_int8_t option,
 
 	for (i = 0; i < optlen; ) {
 		if (op[i] == option) {
-			spin_unlock_bh(&dccp_buflock);
+			spin_unlock(&dccp_buflock);
 			return true;
 		}
 
@@ -71,11 +71,11 @@ dccp_find_option(u_int8_t option,
 			i += op[i+1]?:1;
 	}
 
-	spin_unlock_bh(&dccp_buflock);
+	spin_unlock(&dccp_buflock);
 	return false;
 
 partial:
-	spin_unlock_bh(&dccp_buflock);
+	spin_unlock(&dccp_buflock);
 invalid:
 	*hotdrop = true;
 	return false;
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 32b7a57..08894a4 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -71,7 +71,7 @@ limit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	struct xt_limit_priv *priv = r->master;
 	unsigned long now = jiffies;
 
-	spin_lock_bh(&limit_lock);
+	spin_lock(&limit_lock);
 	priv->credit += (now - xchg(&priv->prev, now)) * CREDITS_PER_JIFFY;
 	if (priv->credit > r->credit_cap)
 		priv->credit = r->credit_cap;
@@ -79,11 +79,11 @@ limit_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (priv->credit >= r->cost) {
 		/* We're not limited. */
 		priv->credit -= r->cost;
-		spin_unlock_bh(&limit_lock);
+		spin_unlock(&limit_lock);
 		return true;
 	}
 
-	spin_unlock_bh(&limit_lock);
+	spin_unlock(&limit_lock);
 	return false;
 }
 
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 70eb2b4..ba2042d 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -28,7 +28,7 @@ quota_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	struct xt_quota_priv *priv = q->master;
 	bool ret = q->flags & XT_QUOTA_INVERT;
 
-	spin_lock_bh(&priv->lock);
+	spin_lock(&priv->lock);
 	if (priv->quota >= skb->len) {
 		priv->quota -= skb->len;
 		ret = !ret;
@@ -36,7 +36,7 @@ quota_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* we do not allow even small packets from now on */
 		priv->quota = 0;
 	}
-	spin_unlock_bh(&priv->lock);
+	spin_unlock(&priv->lock);
 
 	return ret;
 }
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index 76a0831..d69a280 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -22,7 +22,7 @@ xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	u_int32_t bps1, bps2, pps1, pps2;
 	bool ret = true;
 
-	spin_lock_bh(&info->est1->lock);
+	spin_lock(&info->est1->lock);
 	r = &info->est1->rstats;
 	if (info->flags & XT_RATEEST_MATCH_DELTA) {
 		bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0;
@@ -31,13 +31,13 @@ xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		bps1 = r->bps;
 		pps1 = r->pps;
 	}
-	spin_unlock_bh(&info->est1->lock);
+	spin_unlock(&info->est1->lock);
 
 	if (info->flags & XT_RATEEST_MATCH_ABS) {
 		bps2 = info->bps2;
 		pps2 = info->pps2;
 	} else {
-		spin_lock_bh(&info->est2->lock);
+		spin_lock(&info->est2->lock);
 		r = &info->est2->rstats;
 		if (info->flags & XT_RATEEST_MATCH_DELTA) {
 			bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0;
@@ -46,7 +46,7 @@ xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
 			bps2 = r->bps;
 			pps2 = r->pps;
 		}
-		spin_unlock_bh(&info->est2->lock);
+		spin_unlock(&info->est2->lock);
 	}
 
 	switch (info->mode) {
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 76aec6a..5ddd90d 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -259,7 +259,7 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (par->out != NULL && skb->sk == NULL)
 		ttl++;
 
-	spin_lock_bh(&recent_lock);
+	spin_lock(&recent_lock);
 	t = recent_table_lookup(recent_net, info->name);
 	e = recent_entry_lookup(t, &addr, par->family,
 				(info->check_set & XT_RECENT_TTL) ? ttl : 0);
@@ -302,7 +302,7 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		e->ttl = ttl;
 	}
 out:
-	spin_unlock_bh(&recent_lock);
+	spin_unlock(&recent_lock);
 	return ret;
 }
 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ