[NET]: Fix dev->qdisc race for NETDEV_TX_LOCKED case

[net-next-2.6.git] / net / sched / sch_generic.c

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 3b6e6a7809278f69769ca764f65df928d0e023d3..a8240c578772d402ea8bd510f901ff25154e4f66 100644 (file)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -36,37 +36,30 @@
 
 /* Main transmission queue. */
 
-/* Main qdisc structure lock. 
-
-   However, modifications
-   to data, participating in scheduling must be additionally
-   protected with dev->queue_lock spinlock.
-
-   The idea is the following:
-   - enqueue, dequeue are serialized via top level device
-     spinlock dev->queue_lock.
-   - tree walking is protected by read_lock(qdisc_tree_lock)
-     and this lock is used only in process context.
-   - updates to tree are made only under rtnl semaphore,
-     hence this lock may be made without local bh disabling.
-
-   qdisc_tree_lock must be grabbed BEFORE dev->queue_lock!
+/* Modifications to data participating in scheduling must be protected with
+ * dev->queue_lock spinlock.
+ *
+ * The idea is the following:
+ * - enqueue, dequeue are serialized via top level device
+ *   spinlock dev->queue_lock.
+ * - ingress filtering is serialized via top level device
+ *   spinlock dev->ingress_lock.
+ * - updates to tree and tree walking are only done under the rtnl mutex.
  */
-DEFINE_RWLOCK(qdisc_tree_lock);
 
 void qdisc_lock_tree(struct net_device *dev)
 {
-       write_lock(&qdisc_tree_lock);
        spin_lock_bh(&dev->queue_lock);
+       spin_lock(&dev->ingress_lock);
 }
 
 void qdisc_unlock_tree(struct net_device *dev)
 {
+       spin_unlock(&dev->ingress_lock);
        spin_unlock_bh(&dev->queue_lock);
-       write_unlock(&qdisc_tree_lock);
 }
 
-/* 
+/*
    dev->queue_lock serializes queue accesses for this device
    AND dev->qdisc pointer itself.
 
@@ -82,7 +75,7 @@ void qdisc_unlock_tree(struct net_device *dev)
    we do not check dev->tbusy flag here.
 
    Returns:  0  - queue is empty.
-            >0  - queue is not empty, but throttled.
+           >0  - queue is not empty, but throttled.
            <0  - queue is not empty. Device is throttled, if dev->tbusy != 0.
 
    NOTE: Called under dev->queue_lock with locally disabled BH.
@@ -112,7 +105,7 @@ static inline int qdisc_restart(struct net_device *dev)
                        if (!netif_tx_trylock(dev)) {
                        collision:
                                /* So, someone grabbed the driver. */
-                               
+
                                /* It may be transient configuration error,
                                   when hard_start_xmit() recurses. We detect
                                   it by checking xmit owner and drop the
@@ -128,7 +121,7 @@ static inline int qdisc_restart(struct net_device *dev)
                                goto requeue;
                        }
                }
-               
+
                {
                        /* And release queue */
                        spin_unlock(&dev->queue_lock);
@@ -137,7 +130,7 @@ static inline int qdisc_restart(struct net_device *dev)
                                int ret;
 
                                ret = dev_hard_start_xmit(skb, dev);
-                               if (ret == NETDEV_TX_OK) { 
+                               if (ret == NETDEV_TX_OK) {
                                        if (!nolock) {
                                                netif_tx_unlock(dev);
                                        }
@@ -146,15 +139,16 @@ static inline int qdisc_restart(struct net_device *dev)
                                }
                                if (ret == NETDEV_TX_LOCKED && nolock) {
                                        spin_lock(&dev->queue_lock);
-                                       goto collision; 
+                                       q = dev->qdisc;
+                                       goto collision;
                                }
                        }
 
                        /* NETDEV_TX_BUSY - we need to requeue */
                        /* Release the driver */
-                       if (!nolock) { 
+                       if (!nolock) {
                                netif_tx_unlock(dev);
-                       } 
+                       }
                        spin_lock(&dev->queue_lock);
                        q = dev->qdisc;
                }
@@ -300,7 +294,7 @@ struct Qdisc noop_qdisc = {
        .enqueue        =       noop_enqueue,
        .dequeue        =       noop_dequeue,
        .flags          =       TCQ_F_BUILTIN,
-       .ops            =       &noop_qdisc_ops,        
+       .ops            =       &noop_qdisc_ops,
        .list           =       LIST_HEAD_INIT(noop_qdisc.list),
 };
 
@@ -442,7 +436,6 @@ struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
        sch->dequeue = ops->dequeue;
        sch->dev = dev;
        dev_hold(dev);
-       sch->stats_lock = &dev->queue_lock;
        atomic_set(&sch->refcnt, 1);
 
        return sch;
@@ -454,10 +447,11 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops,
                                 unsigned int parentid)
 {
        struct Qdisc *sch;
-       
+
        sch = qdisc_alloc(dev, ops);
        if (IS_ERR(sch))
                goto errout;
+       sch->stats_lock = &dev->queue_lock;
        sch->parent = parentid;
 
        if (!ops->init || ops->init(sch, NULL) == 0)
@@ -478,7 +472,7 @@ void qdisc_reset(struct Qdisc *qdisc)
                ops->reset(qdisc);
 }
 
-/* this is the rcu callback function to clean up a qdisc when there 
+/* this is the rcu callback function to clean up a qdisc when there
  * are no further references to it */
 
 static void __qdisc_destroy(struct rcu_head *head)
@@ -528,15 +522,11 @@ void dev_activate(struct net_device *dev)
                                printk(KERN_INFO "%s: activation failed\n", dev->name);
                                return;
                        }
-                       write_lock(&qdisc_tree_lock);
                        list_add_tail(&qdisc->list, &dev->qdisc_list);
-                       write_unlock(&qdisc_tree_lock);
                } else {
                        qdisc =  &noqueue_qdisc;
                }
-               write_lock(&qdisc_tree_lock);
                dev->qdisc_sleeping = qdisc;
-               write_unlock(&qdisc_tree_lock);
        }
 
        if (!netif_carrier_ok(dev))
@@ -600,10 +590,10 @@ void dev_shutdown(struct net_device *dev)
        dev->qdisc_sleeping = &noop_qdisc;
        qdisc_destroy(qdisc);
 #if defined(CONFIG_NET_SCH_INGRESS) || defined(CONFIG_NET_SCH_INGRESS_MODULE)
-        if ((qdisc = dev->qdisc_ingress) != NULL) {
+       if ((qdisc = dev->qdisc_ingress) != NULL) {
                dev->qdisc_ingress = NULL;
                qdisc_destroy(qdisc);
-        }
+       }
 #endif
        BUG_TRAP(!timer_pending(&dev->watchdog_timer));
        qdisc_unlock_tree(dev);