netfilter: conntrack: switch connlabels to atomic_t

The spinlock is back from the day when connabels did not have
a fixed size and reallocation had to be supported.

Remove it.  This change also allows to call the helpers from
softirq or timers without deadlocks.

Also add WARN()s to catch refcounting imbalances.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index fcb19a4e8f2b2af99e73815259c5daef0366a7ff..6903f72bcc158a0acdcf69da31cebfb0a0086959 100644 (file)
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -39,7 +39,7 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
 #ifdef CONFIG_NF_CONNTRACK_LABELS
        struct net *net = nf_ct_net(ct);
 
-       if (net->ct.labels_used == 0)
+       if (atomic_read(&net->ct.labels_used) == 0)
                return NULL;
 
        return nf_ct_ext_add(ct, NF_CT_EXT_LABELS, GFP_ATOMIC);

diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 1f463b3957c78065708d87f4aec6d9d6e15c8b13..bae914815aa386bbc24621d7805ee11900c048f0 100644 (file)
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -107,7 +107,7 @@ struct netns_ct {
        struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
        struct nf_ip_net        nf_ct_proto;
 #if defined(CONFIG_NF_CONNTRACK_LABELS)
-       unsigned int            labels_used;
+       atomic_t                labels_used;
 #endif
 };
 #endif

diff --git a/net/netfilter/nf_conntrack_labels.c b/net/netfilter/nf_conntrack_labels.c
index 6e70e137a0a608e59501e758fedee8215d614fce..6c46aad2331398ba3099a5702bb532bd30c168a9 100644 (file)
--- a/net/netfilter/nf_conntrack_labels.c
+++ b/net/netfilter/nf_conntrack_labels.c
@@ -11,8 +11,6 @@
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_labels.h>
 
-static DEFINE_SPINLOCK(nf_connlabels_lock);
-
 static int replace_u32(u32 *address, u32 mask, u32 new)
 {
        u32 old, tmp;
@@ -60,23 +58,24 @@ EXPORT_SYMBOL_GPL(nf_connlabels_replace);
 
 int nf_connlabels_get(struct net *net, unsigned int bits)
 {
+       int v;
+
        if (BIT_WORD(bits) >= NF_CT_LABELS_MAX_SIZE / sizeof(long))
                return -ERANGE;
 
-       spin_lock(&nf_connlabels_lock);
-       net->ct.labels_used++;
-       spin_unlock(&nf_connlabels_lock);
-
        BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE / sizeof(long) >= U8_MAX);
 
+       v = atomic_inc_return_relaxed(&net->ct.labels_used);
+       WARN_ON_ONCE(v <= 0);
+
        return 0;
 }
 EXPORT_SYMBOL_GPL(nf_connlabels_get);
 
 void nf_connlabels_put(struct net *net)
 {
-       spin_lock(&nf_connlabels_lock);
-       net->ct.labels_used--;
-       spin_unlock(&nf_connlabels_lock);
+       int v = atomic_dec_return_relaxed(&net->ct.labels_used);
+
+       WARN_ON_ONCE(v < 0);
 }
 EXPORT_SYMBOL_GPL(nf_connlabels_put);