The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Acked-by: NJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This reverts commit 0c0b3ae6.

Quoth David:

  "Jeff, please revert

   It's wrong.  We had a lengthy analysis of this piece of code
   several months ago, and it is correct.

   Consider, if we run the loop and we get an error
   the following happens:

   1) attempt of ifb_init_one(i) fails, therefore we should
      not try to "ifb_free_one()" on "i" since it failed
   2) the loop iteration first increments "i", then it
      check for error

   Therefore we must decrement "i" twice before the first
   free during the cleanup.  One to "undo" the for() loop
   increment, and one to "skip" the ifb_init_one() case which
   failed."
Reported-by: NDavid Miller <davem@davemloft.net>
Acked-by: NJeff Garzik <jgarzik@pobox.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

On error we should start freeing resources at [i-1] not [i-2].
Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Signed-off-by: Ndean gaudet <dean@arctic.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

ifb: replace missing comma to separate pr_debug arguments
Signed-off-by: NZach Brown <zach.brown@oracle.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NJeff Garzik <jeff@garzik.org>

It before entering in the loop for freeing the other ifb devices.
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: NJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NJörn Engel <joern@wohnheim.fh-wedel.de>
Signed-off-by: NAdrian Bunk <bunk@stusta.de>

Various drivers use xmit_lock internally to synchronise with their
transmission routines.  They do so without setting xmit_lock_owner.
This is fine as long as netpoll is not in use.

With netpoll it is possible for deadlocks to occur if xmit_lock_owner
isn't set.  This is because if a printk occurs while xmit_lock is held
and xmit_lock_owner is not set can cause netpoll to attempt to take
xmit_lock recursively.

While it is possible to resolve this by getting netpoll to use
trylock, it is suboptimal because netpoll's sole objective is to
maximise the chance of getting the printk out on the wire.  So
delaying or dropping the message is to be avoided as much as possible.

So the only alternative is to always set xmit_lock_owner.  The
following patch does this by introducing the netif_tx_lock family of
functions that take care of setting/unsetting xmit_lock_owner.

I renamed xmit_lock to _xmit_lock to indicate that it should not be
used directly.  I didn't provide irq versions of the netif_tx_lock
functions since xmit_lock is meant to be a BH-disabling lock.

This is pretty much a straight text substitution except for a small
bug fix in winbond.  It currently uses
netif_stop_queue/spin_unlock_wait to stop transmission.  This is
unsafe as an IRQ can potentially wake up the queue.  So it is safer to
use netif_tx_disable.

The hamradio bits used spin_lock_irq but it is unnecessary as
xmit_lock must never be taken in an IRQ handler.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The most usable number of ifb devices is 2. Change the default to 2.
Signed-off-by: NRichard Lucassen <spamtrap@lucassen.org>
Signed-off-by: NJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

A new device to do intermidiate functional block in a system shared
manner.  To use the new functionality, you need to turn on
qos/classifier actions.

The new functionality can be grouped as:

1) qdiscs/policies that are per device as opposed to system wide.  ifb
allows for a device which can be redirected to thus providing an
impression of sharing.

2) Allows for queueing incoming traffic for shaping instead of
dropping.

Packets are redirected to this device using tc/action mirred redirect
construct. If they are sent to it by plain routing instead then they
will merely be dropped and the stats would indicate that.
Signed-off-by: NJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>