Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (55 commits)
  net: fib_rules: fix error code for unsupported families
  netdevice: Fix wrong string handle in kernel command line parsing
  net: Tyop of sk_filter() comment
  netlink: Unneeded local variable
  net-sched: fix filter destruction in atm/hfsc qdisc destruction
  net-sched: change tcf_destroy_chain() to clear start of filter list
  ipv4: fix sysctl documentation of time related values
  mac80211: don't accept WEP keys other than WEP40 and WEP104
  hostap: fix sparse warnings
  hostap: don't report useless WDS frames by default
  textsearch: fix Boyer-Moore text search bug
  netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid ACK
  ipv6 route: Convert rt6_device_match() to use RT6_LOOKUP_F_xxx flags.
  netlabel: Fix a problem when dumping the default IPv6 static labels
  net/inet_lro: remove setting skb->ip_summed when not LRO-able
  inet fragments: fix race between inet_frag_find and inet_frag_secret_rebuild
  CONNECTOR: add a proc entry to list connectors
  netlink: Fix some doc comments in net/netlink/attr.c
  tcp: /proc/net/tcp rto,ato values not scaled properly (v2)
  include/linux/netdevice.h: don't export MAX_HEADER to userspace
  ...

1 files changed, 11 insertions, 5 deletions

diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 4ed429bd595..0546a0bc97e 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -192,14 +192,21 @@ EXPORT_SYMBOL(inet_frag_evictor);
 
 static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
 		struct inet_frag_queue *qp_in, struct inet_frags *f,
-		unsigned int hash, void *arg)
+		void *arg)
 {
 	struct inet_frag_queue *qp;
 #ifdef CONFIG_SMP
 	struct hlist_node *n;
 #endif
+	unsigned int hash;
 
 	write_lock(&f->lock);
+	/*
+	 * While we stayed w/o the lock other CPU could update
+	 * the rnd seed, so we need to re-calculate the hash
+	 * chain. Fortunatelly the qp_in can be used to get one.
+	 */
+	hash = f->hashfn(qp_in);
 #ifdef CONFIG_SMP
 	/* With SMP race we have to recheck hash table, because
 	 * such entry could be created on other cpu, while we
@@ -247,7 +254,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 }
 
 static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
-		struct inet_frags *f, void *arg, unsigned int hash)
+		struct inet_frags *f, void *arg)
 {
 	struct inet_frag_queue *q;
 
@@ -255,7 +262,7 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
 	if (q == NULL)
 		return NULL;
 
-	return inet_frag_intern(nf, q, f, hash, arg);
+	return inet_frag_intern(nf, q, f, arg);
 }
 
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
@@ -264,7 +271,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
 	struct inet_frag_queue *q;
 	struct hlist_node *n;
 
-	read_lock(&f->lock);
 	hlist_for_each_entry(q, n, &f->hash[hash], list) {
 		if (q->net == nf && f->match(q, key)) {
 			atomic_inc(&q->refcnt);
@@ -274,6 +280,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
 	}
 	read_unlock(&f->lock);
 
-	return inet_frag_create(nf, f, key, hash);
+	return inet_frag_create(nf, f, key);
 }
 EXPORT_SYMBOL(inet_frag_find);