[openib-general] [PATCH -stable] Move destructor from neigh->ops to neigh_param

[Michael S. Tsirkin]

Hello, -stable team!
The following patch is a backport from 2.6.17-rc1: is solves an oops/crash
condition in ipoib that people are observing in 2.6.16/2.6.16.1.

The patch exceeds the 100 line limit slightly, but only because it
removes a static function which now becomes unused. Let me know if this
is a problem.

---

From: Michael S. Tsirkin <mst at mellanox.co.il>

struct neigh_ops currently has a destructor field, but not a constructor field.
The infiniband/ulp/ipoib in-tree driver stashes some info in the neighbour
structure (the results of the second-stage lookup from ARP results to real
link-level path), and it uses neigh->ops->destructor to get a callback so it can
clean up this extra info when a neighbour is freed.  We've run into problems
with this: since the destructor is in an ops field that is shared between
neighbours that may belong to different net devices, there's no way to set/clear
it safely.

The following patch moves this field to neigh_parms where it can be safely set,
together with its twin neigh_setup, and switches the only two in-kernel users
(ipoib and clip) to this interface.

Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd at cisco.com>

Index: linux-2.6.16/drivers/infiniband/ulp/ipoib/ipoib_main.c
===================================================================
--- linux-2.6.16.orig/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-03-20 07:53:29.000000000 +0200
+++ linux-2.6.16/drivers/infiniband/ulp/ipoib/ipoib_main.c	2006-04-03 17:09:23.000000000 +0200
@@ -247,7 +247,6 @@ static void path_free(struct net_device 
 		if (neigh->ah)
 			ipoib_put_ah(neigh->ah);
 		*to_ipoib_neigh(neigh->neighbour) = NULL;
-		neigh->neighbour->ops->destructor = NULL;
 		kfree(neigh);
 	}
 
@@ -530,7 +529,6 @@ static void neigh_add_path(struct sk_buf
 err:
 	*to_ipoib_neigh(skb->dst->neighbour) = NULL;
 	list_del(&neigh->list);
-	neigh->neighbour->ops->destructor = NULL;
 	kfree(neigh);
 
 	++priv->stats.tx_dropped;
@@ -769,21 +767,9 @@ static void ipoib_neigh_destructor(struc
 		ipoib_put_ah(ah);
 }
 
-static int ipoib_neigh_setup(struct neighbour *neigh)
-{
-	/*
-	 * Is this kosher?  I can't find anybody in the kernel that
-	 * sets neigh->destructor, so we should be able to set it here
-	 * without trouble.
-	 */
-	neigh->ops->destructor = ipoib_neigh_destructor;
-
-	return 0;
-}
-
 static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms)
 {
-	parms->neigh_setup = ipoib_neigh_setup;
+	parms->neigh_destructor = ipoib_neigh_destructor;
 
 	return 0;
 }
Index: linux-2.6.16/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
===================================================================
--- linux-2.6.16.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2006-03-20 07:53:29.000000000 +0200
+++ linux-2.6.16/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2006-04-03 17:09:23.000000000 +0200
@@ -115,7 +115,6 @@ static void ipoib_mcast_free(struct ipoi
 		if (neigh->ah)
 			ipoib_put_ah(neigh->ah);
 		*to_ipoib_neigh(neigh->neighbour) = NULL;
-		neigh->neighbour->ops->destructor = NULL;
 		kfree(neigh);
 	}
 
Index: linux-2.6.16/include/net/neighbour.h
===================================================================
--- linux-2.6.16.orig/include/net/neighbour.h	2006-03-20 07:53:29.000000000 +0200
+++ linux-2.6.16/include/net/neighbour.h	2006-04-03 17:09:23.000000000 +0200
@@ -68,6 +68,7 @@ struct neigh_parms
 	struct net_device *dev;
 	struct neigh_parms *next;
 	int	(*neigh_setup)(struct neighbour *);
+	void	(*neigh_destructor)(struct neighbour *);
 	struct neigh_table *tbl;
 
 	void	*sysctl_table;
@@ -145,7 +146,6 @@ struct neighbour
 struct neigh_ops
 {
 	int			family;
-	void			(*destructor)(struct neighbour *);
 	void			(*solicit)(struct neighbour *, struct sk_buff*);
 	void			(*error_report)(struct neighbour *, struct sk_buff*);
 	int			(*output)(struct sk_buff*);
Index: linux-2.6.16/net/atm/clip.c
===================================================================
--- linux-2.6.16.orig/net/atm/clip.c	2006-03-20 07:53:29.000000000 +0200
+++ linux-2.6.16/net/atm/clip.c	2006-04-03 17:14:45.000000000 +0200
@@ -289,7 +289,6 @@ static void clip_neigh_error(struct neig
 
 static struct neigh_ops clip_neigh_ops = {
 	.family =		AF_INET,
-	.destructor =		clip_neigh_destroy,
 	.solicit =		clip_neigh_solicit,
 	.error_report =		clip_neigh_error,
 	.output =		dev_queue_xmit,
@@ -346,6 +345,7 @@ static struct neigh_table clip_tbl = {
 
 	/* parameters are copied from ARP ... */
 	.parms = {
+		.neigh_destructor	= clip_neigh_destroy,
 		.tbl 			= &clip_tbl,
 		.base_reachable_time 	= 30 * HZ,
 		.retrans_time 		= 1 * HZ,
Index: linux-2.6.16/net/core/neighbour.c
===================================================================
--- linux-2.6.16.orig/net/core/neighbour.c	2006-03-20 07:53:29.000000000 +0200
+++ linux-2.6.16/net/core/neighbour.c	2006-04-03 17:09:23.000000000 +0200
@@ -586,8 +586,8 @@ void neigh_destroy(struct neighbour *nei
 			kfree(hh);
 	}
 
-	if (neigh->ops && neigh->ops->destructor)
-		(neigh->ops->destructor)(neigh);
+	if (neigh->parms->neigh_destructor)
+		(neigh->parms->neigh_destructor)(neigh);
 
 	skb_queue_purge(&neigh->arp_queue);
 

-- 
Michael S. Tsirkin
Staff Engineer, Mellanox Technologies