1 files changed, 38 insertions, 23 deletions

diff --git a/net/netfilter/xt_quota2.c b/net/netfilter/xt_quota2.c
index 4857008f1eb0..454ce10c8cdc 100644
--- a/net/netfilter/xt_quota2.c
+++ b/net/netfilter/xt_quota2.c
@@ -18,8 +18,7 @@
 #include <asm/atomic.h>
 
 #include <linux/netfilter/x_tables.h>
-#include "xt_quota2.h"
-#include "compat_xtables.h"
+#include <linux/netfilter/xt_quota2.h>
 
 /**
  * @lock:	lock to protect quota writers from each other
@@ -91,7 +90,7 @@ q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
 	if (!anon) {
 		INIT_LIST_HEAD(&e->list);
 		atomic_set(&e->ref, 1);
-		strncpy(e->name, q->name, sizeof(e->name));
+		strlcpy(e->name, q->name, sizeof(e->name));
 	}
 	return e;
 }
@@ -104,42 +103,56 @@ static struct xt_quota_counter *
 q2_get_counter(const struct xt_quota_mtinfo2 *q)
 {
 	struct proc_dir_entry *p;
-	struct xt_quota_counter *e;
+	struct xt_quota_counter *e = NULL;
+	struct xt_quota_counter *new_e;
 
 	if (*q->name == '\0')
 		return q2_new_counter(q, true);
 
+	/* No need to hold a lock while getting a new counter */
+	new_e = q2_new_counter(q, false);
+	if (new_e == NULL)
+		goto out;
+
 	spin_lock_bh(&counter_list_lock);
 	list_for_each_entry(e, &counter_list, list)
 		if (strcmp(e->name, q->name) == 0) {
 			atomic_inc(&e->ref);
 			spin_unlock_bh(&counter_list_lock);
+			kfree(new_e);
+			pr_debug("xt_quota2: old counter name=%s", e->name);
 			return e;
 		}
+	e = new_e;
+	pr_debug("xt_quota2: new_counter name=%s", e->name);
+	list_add_tail(&e->list, &counter_list);
+	/* The entry having a refcount of 1 is not directly destructible.
+	 * This func has not yet returned the new entry, thus iptables
+	 * has not references for destroying this entry.
+	 * For another rule to try to destroy it, it would 1st need for this
+	 * func* to be re-invoked, acquire a new ref for the same named quota.
+	 * Nobody will access the e->procfs_entry either.
+	 * So release the lock. */
+	spin_unlock_bh(&counter_list_lock);
 
-	e = q2_new_counter(q, false);
-	if (e == NULL)
-		goto out;
-
+	/* create_proc_entry() is not spin_lock happy */
 	p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
 	                      proc_xt_quota);
-	if (p == NULL || IS_ERR(p))
-		goto out;
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
-	p->owner        = THIS_MODULE;
-#endif
+	if (IS_ERR_OR_NULL(p)) {
+		spin_lock_bh(&counter_list_lock);
+		list_del(&e->list);
+		spin_unlock_bh(&counter_list_lock);
+		goto out;
+	}
 	p->data         = e;
 	p->read_proc    = quota_proc_read;
 	p->write_proc   = quota_proc_write;
 	p->uid          = quota_list_uid;
 	p->gid          = quota_list_gid;
-	list_add_tail(&e->list, &counter_list);
-	spin_unlock_bh(&counter_list_lock);
 	return e;
 
  out:
-	spin_unlock_bh(&counter_list_lock);
 	kfree(e);
 	return NULL;
 }
@@ -148,6 +161,8 @@ static int quota_mt2_check(const struct xt_mtchk_param *par)
 {
 	struct xt_quota_mtinfo2 *q = par->matchinfo;
 
+	pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
+
 	if (q->flags & ~XT_QUOTA_MASK)
 		return -EINVAL;
 
@@ -203,7 +218,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
 		 */
 		if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
 			e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
-			q->quota = e->quota;
 		}
 		ret = true;
 	} else {
@@ -215,7 +229,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
 			/* we do not allow even small packets from now on */
 			e->quota = 0;
 		}
-		q->quota = e->quota;
 	}
 	spin_unlock_bh(&e->lock);
 	return ret;
@@ -228,7 +241,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
 		.family     = NFPROTO_IPV4,
 		.checkentry = quota_mt2_check,
 		.match      = quota_mt2,
-		.destroy    = quota_mt2_destroy,  
+		.destroy    = quota_mt2_destroy,
 		.matchsize  = sizeof(struct xt_quota_mtinfo2),
 		.me         = THIS_MODULE,
 	},
@@ -238,7 +251,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
 		.family     = NFPROTO_IPV6,
 		.checkentry = quota_mt2_check,
 		.match      = quota_mt2,
-		.destroy    = quota_mt2_destroy,  
+		.destroy    = quota_mt2_destroy,
 		.matchsize  = sizeof(struct xt_quota_mtinfo2),
 		.me         = THIS_MODULE,
 	},
@@ -247,21 +260,23 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
 static int __init quota_mt2_init(void)
 {
 	int ret;
+	pr_debug("xt_quota2: init()");
 
-	proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);
+	proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
 	if (proc_xt_quota == NULL)
 		return -EACCES;
 
 	ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
 	if (ret < 0)
-		remove_proc_entry("xt_quota", init_net__proc_net);
+		remove_proc_entry("xt_quota", init_net.proc_net);
+	pr_debug("xt_quota2: init() %d", ret);
 	return ret;
 }
 
 static void __exit quota_mt2_exit(void)
 {
 	xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
-	remove_proc_entry("xt_quota", init_net__proc_net);
+	remove_proc_entry("xt_quota", init_net.proc_net);
 }
 
 module_init(quota_mt2_init);