netfilter: use in_dev_for_each_ifa_rcu

Netfilter hooks are always running under rcu read lock, use
the new iterator macro so sparse won't complain once we add
proper __rcu annotations.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c
index 16471410496592f52ac7927d218a44341f139339..40c93b3bd7316819e9d8a986d5c278e16358a1ac 100644 (file)
--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c
+++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c
@@ -53,6 +53,7 @@ EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait4);
 
 __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 {
+       const struct in_ifaddr *ifa;
        struct in_device *indev;
        __be32 laddr;
 
@@ -61,10 +62,14 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 
        laddr = 0;
        indev = __in_dev_get_rcu(skb->dev);
-       for_primary_ifa(indev) {
+
+       in_dev_for_each_ifa_rcu(ifa, indev) {
+               if (ifa->ifa_flags & IFA_F_SECONDARY)
+                       continue;
+
                laddr = ifa->ifa_local;
                break;
-       } endfor_ifa(indev);
+       }
 
        return laddr ? laddr : daddr;
 }

diff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c
index 5423b197d98a2b49e2ecc6e6de901702302f834e..a5dbc3676a4f9aaa2ddd7f48dd19d05a0be31faa 100644 (file)
--- a/net/netfilter/nf_conntrack_broadcast.c
+++ b/net/netfilter/nf_conntrack_broadcast.c
@@ -41,12 +41,17 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb,
 
        in_dev = __in_dev_get_rcu(rt->dst.dev);
        if (in_dev != NULL) {
-               for_primary_ifa(in_dev) {
+               const struct in_ifaddr *ifa;
+
+               in_dev_for_each_ifa_rcu(ifa, in_dev) {
+                       if (ifa->ifa_flags & IFA_F_SECONDARY)
+                               continue;
+
                        if (ifa->ifa_broadcast == iph->daddr) {
                                mask = ifa->ifa_mask;
                                break;
                        }
-               } endfor_ifa(in_dev);
+               }
        }
 
        if (mask == 0)

diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index f42326b40d6faadd3b5dbeb1997a03f743acc3a8..9f5dea0064ea86b52dbca0c1e127564be91a7cca 100644 (file)
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -33,6 +33,7 @@ static inline int nf_osf_ttl(const struct sk_buff *skb,
 {
        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
        const struct iphdr *ip = ip_hdr(skb);
+       const struct in_ifaddr *ifa;
        int ret = 0;
 
        if (ttl_check == NF_OSF_TTL_TRUE)
@@ -42,15 +43,13 @@ static inline int nf_osf_ttl(const struct sk_buff *skb,
        else if (ip->ttl <= f_ttl)
                return 1;
 
-       for_ifa(in_dev) {
+       in_dev_for_each_ifa_rcu(ifa, in_dev) {
                if (inet_ifa_match(ip->saddr, ifa)) {
                        ret = (ip->ttl == f_ttl);
                        break;
                }
        }
 
-       endfor_ifa(in_dev);
-
        return ret;
 }