Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 809388,
    "url": "http://patchwork.ozlabs.org/api/1.2/patches/809388/?format=api",
    "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/1504477589-12045-4-git-send-email-pablo@netfilter.org/",
    "project": {
        "id": 26,
        "url": "http://patchwork.ozlabs.org/api/1.2/projects/26/?format=api",
        "name": "Netfilter Development",
        "link_name": "netfilter-devel",
        "list_id": "netfilter-devel.vger.kernel.org",
        "list_email": "netfilter-devel@vger.kernel.org",
        "web_url": null,
        "scm_url": null,
        "webscm_url": null,
        "list_archive_url": "",
        "list_archive_url_format": "",
        "commit_url_format": ""
    },
    "msgid": "<1504477589-12045-4-git-send-email-pablo@netfilter.org>",
    "list_archive_url": null,
    "date": "2017-09-03T22:25:45",
    "name": "[03/47] netfilter: Remove duplicated rcu_read_lock.",
    "commit_ref": null,
    "pull_url": null,
    "state": "accepted",
    "archived": false,
    "hash": "8e039d1c3f4bea5aa7fb1402a13f07e57472bca1",
    "submitter": {
        "id": 1315,
        "url": "http://patchwork.ozlabs.org/api/1.2/people/1315/?format=api",
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org"
    },
    "delegate": {
        "id": 6139,
        "url": "http://patchwork.ozlabs.org/api/1.2/users/6139/?format=api",
        "username": "pablo",
        "first_name": "Pablo",
        "last_name": "Neira",
        "email": "pablo@netfilter.org"
    },
    "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/1504477589-12045-4-git-send-email-pablo@netfilter.org/mbox/",
    "series": [
        {
            "id": 1280,
            "url": "http://patchwork.ozlabs.org/api/1.2/series/1280/?format=api",
            "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=1280",
            "date": "2017-09-03T22:25:42",
            "name": "[01/47] netfilter: expect: add to hash table after expect init",
            "version": 1,
            "mbox": "http://patchwork.ozlabs.org/series/1280/mbox/"
        }
    ],
    "comments": "http://patchwork.ozlabs.org/api/patches/809388/comments/",
    "check": "pending",
    "checks": "http://patchwork.ozlabs.org/api/patches/809388/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "<netfilter-devel-owner@vger.kernel.org>",
        "X-Original-To": "incoming@patchwork.ozlabs.org",
        "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org",
        "Authentication-Results": "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netfilter-devel-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)",
        "Received": [
            "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xlnfh36zyz9s06\n\tfor <incoming@patchwork.ozlabs.org>;\n\tMon,  4 Sep 2017 08:27:40 +1000 (AEST)",
            "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1753219AbdICW1Z (ORCPT <rfc822;incoming@patchwork.ozlabs.org>);\n\tSun, 3 Sep 2017 18:27:25 -0400",
            "from mail.us.es ([193.147.175.20]:50786 \"EHLO mail.us.es\"\n\trhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP\n\tid S1753019AbdICW0m (ORCPT <rfc822; netfilter-devel@vger.kernel.org>);\n\tSun, 3 Sep 2017 18:26:42 -0400",
            "from antivirus1-rhel7.int (unknown [192.168.2.11])\n\tby mail.us.es (Postfix) with ESMTP id EAE1F190F68\n\tfor <netfilter-devel@vger.kernel.org>;\n\tMon,  4 Sep 2017 00:26:14 +0200 (CEST)",
            "from antivirus1-rhel7.int (localhost [127.0.0.1])\n\tby antivirus1-rhel7.int (Postfix) with ESMTP id D07B5B5027\n\tfor <netfilter-devel@vger.kernel.org>;\n\tMon,  4 Sep 2017 00:26:14 +0200 (CEST)",
            "by antivirus1-rhel7.int (Postfix, from userid 99)\n\tid C5A3BB502E; Mon,  4 Sep 2017 00:26:14 +0200 (CEST)",
            "from antivirus1-rhel7.int (localhost [127.0.0.1])\n\tby antivirus1-rhel7.int (Postfix) with ESMTP id 9528EB5026;\n\tMon,  4 Sep 2017 00:26:11 +0200 (CEST)",
            "from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int\n\t(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); \n\tMon, 04 Sep 2017 00:26:11 +0200 (CEST)",
            "from salvia.here (unknown [31.4.193.113])\n\t(Authenticated sender: pneira@us.es)\n\tby entrada.int (Postfix) with ESMTPA id 2E9194265A22;\n\tMon,  4 Sep 2017 00:26:11 +0200 (CEST)"
        ],
        "X-Spam-Checker-Version": "SpamAssassin 3.4.1 (2015-04-28) on\n\tantivirus1-rhel7.int",
        "X-Spam-Level": "",
        "X-Spam-Status": "No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50,\n\tSMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1",
        "X-Virus-Status": "clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int)",
        "X-SMTPAUTHUS": "auth mail.us.es",
        "From": "Pablo Neira Ayuso <pablo@netfilter.org>",
        "To": "netfilter-devel@vger.kernel.org",
        "Cc": "davem@davemloft.net, netdev@vger.kernel.org",
        "Subject": "[PATCH 03/47] netfilter: Remove duplicated rcu_read_lock.",
        "Date": "Mon,  4 Sep 2017 00:25:45 +0200",
        "Message-Id": "<1504477589-12045-4-git-send-email-pablo@netfilter.org>",
        "X-Mailer": "git-send-email 2.1.4",
        "In-Reply-To": "<1504477589-12045-1-git-send-email-pablo@netfilter.org>",
        "References": "<1504477589-12045-1-git-send-email-pablo@netfilter.org>",
        "X-Virus-Scanned": "ClamAV using ClamSMTP",
        "Sender": "netfilter-devel-owner@vger.kernel.org",
        "Precedence": "bulk",
        "List-ID": "<netfilter-devel.vger.kernel.org>",
        "X-Mailing-List": "netfilter-devel@vger.kernel.org"
    },
    "content": "From: Taehee Yoo <ap420073@gmail.com>\n\nThis patch removes duplicate rcu_read_lock().\n\n1. IPVS part:\n\nAccording to Julian Anastasov's mention, contexts of ipvs are described\nat: http://marc.info/?l=netfilter-devel&m=149562884514072&w=2, in summary:\n\n - packet RX/TX: does not need locks because packets come from hooks.\n - sync msg RX: backup server uses RCU locks while registering new\n   connections.\n - ip_vs_ctl.c: configuration get/set, RCU locks needed.\n - xt_ipvs.c: It is a netfilter match, running from hook context.\n\nAs result, rcu_read_lock and rcu_read_unlock can be removed from:\n\n - ip_vs_core.c: all\n - ip_vs_ctl.c:\n   - only from ip_vs_has_real_service\n - ip_vs_ftp.c: all\n - ip_vs_proto_sctp.c: all\n - ip_vs_proto_tcp.c: all\n - ip_vs_proto_udp.c: all\n - ip_vs_xmit.c: all (contains only packet processing)\n\n2. Netfilter part:\n\nThere are three types of functions that are guaranteed the rcu_read_lock().\nFirst, as result, functions are only called by nf_hook():\n\n - nf_conntrack_broadcast_help(), pptp_expectfn(), set_expected_rtp_rtcp().\n - tcpmss_reverse_mtu(), tproxy_laddr4(), tproxy_laddr6().\n - match_lookup_rt6(), check_hlist(), hashlimit_mt_common().\n - xt_osf_match_packet().\n\nSecond, functions that caller already held the rcu_read_lock().\n - destroy_conntrack(), ctnetlink_conntrack_event().\n - ctnl_timeout_find_get(), nfqnl_nf_hook_drop().\n\nThird, functions that are mixed with type1 and type2.\n\nThese functions are called by nf_hook() also these are called by\nordinary functions that already held the rcu_read_lock():\n\n - __ctnetlink_glue_build(), ctnetlink_expect_event().\n - ctnetlink_proto_size().\n\nApplied files are below:\n\n- nf_conntrack_broadcast.c, nf_conntrack_core.c, nf_conntrack_netlink.c.\n- nf_conntrack_pptp.c, nf_conntrack_sip.c, nfnetlink_cttimeout.c.\n- nfnetlink_queue.c, xt_TCPMSS.c, xt_TPROXY.c, xt_addrtype.c.\n- xt_connlimit.c, xt_hashlimit.c, xt_osf.c\n\nDetailed calltrace can be found at:\nhttp://marc.info/?l=netfilter-devel&m=149667610710350&w=2\n\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nAcked-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/netfilter/ipvs/ip_vs_core.c        |  8 ------\n net/netfilter/ipvs/ip_vs_ctl.c         |  3 ---\n net/netfilter/ipvs/ip_vs_ftp.c         |  2 --\n net/netfilter/ipvs/ip_vs_proto_sctp.c  | 11 ++------\n net/netfilter/ipvs/ip_vs_proto_tcp.c   | 10 +-------\n net/netfilter/ipvs/ip_vs_proto_udp.c   | 10 +-------\n net/netfilter/ipvs/ip_vs_xmit.c        | 46 +++-------------------------------\n net/netfilter/nf_conntrack_broadcast.c |  2 --\n net/netfilter/nf_conntrack_core.c      |  3 ---\n net/netfilter/nf_conntrack_netlink.c   | 12 ---------\n net/netfilter/nf_conntrack_pptp.c      |  2 --\n net/netfilter/nf_conntrack_sip.c       |  6 +----\n net/netfilter/nfnetlink_cttimeout.c    |  2 --\n net/netfilter/nfnetlink_queue.c        |  2 --\n net/netfilter/xt_TCPMSS.c              |  2 --\n net/netfilter/xt_TPROXY.c              |  4 ---\n net/netfilter/xt_addrtype.c            |  3 ---\n net/netfilter/xt_connlimit.c           |  3 ---\n net/netfilter/xt_hashlimit.c           |  8 +++---\n net/netfilter/xt_osf.c                 |  2 --\n 20 files changed, 13 insertions(+), 128 deletions(-)",
    "diff": "diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c\nindex e31956b58aba..2ff9d9070c95 100644\n--- a/net/netfilter/ipvs/ip_vs_core.c\n+++ b/net/netfilter/ipvs/ip_vs_core.c\n@@ -125,14 +125,12 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)\n \t\ts->cnt.inbytes += skb->len;\n \t\tu64_stats_update_end(&s->syncp);\n \n-\t\trcu_read_lock();\n \t\tsvc = rcu_dereference(dest->svc);\n \t\ts = this_cpu_ptr(svc->stats.cpustats);\n \t\tu64_stats_update_begin(&s->syncp);\n \t\ts->cnt.inpkts++;\n \t\ts->cnt.inbytes += skb->len;\n \t\tu64_stats_update_end(&s->syncp);\n-\t\trcu_read_unlock();\n \n \t\ts = this_cpu_ptr(ipvs->tot_stats.cpustats);\n \t\tu64_stats_update_begin(&s->syncp);\n@@ -159,14 +157,12 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)\n \t\ts->cnt.outbytes += skb->len;\n \t\tu64_stats_update_end(&s->syncp);\n \n-\t\trcu_read_lock();\n \t\tsvc = rcu_dereference(dest->svc);\n \t\ts = this_cpu_ptr(svc->stats.cpustats);\n \t\tu64_stats_update_begin(&s->syncp);\n \t\ts->cnt.outpkts++;\n \t\ts->cnt.outbytes += skb->len;\n \t\tu64_stats_update_end(&s->syncp);\n-\t\trcu_read_unlock();\n \n \t\ts = this_cpu_ptr(ipvs->tot_stats.cpustats);\n \t\tu64_stats_update_begin(&s->syncp);\n@@ -1222,7 +1218,6 @@ static struct ip_vs_conn *__ip_vs_rs_conn_out(unsigned int hooknum,\n \tif (!pptr)\n \t\treturn NULL;\n \n-\trcu_read_lock();\n \tdest = ip_vs_find_real_service(ipvs, af, iph->protocol,\n \t\t\t\t       &iph->saddr, pptr[0]);\n \tif (dest) {\n@@ -1237,7 +1232,6 @@ static struct ip_vs_conn *__ip_vs_rs_conn_out(unsigned int hooknum,\n \t\t\t\t\t\t  pptr[0], pptr[1]);\n \t\t}\n \t}\n-\trcu_read_unlock();\n \n \treturn cp;\n }\n@@ -1689,11 +1683,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,\n \t\t\tif (dest) {\n \t\t\t\tstruct ip_vs_dest_dst *dest_dst;\n \n-\t\t\t\trcu_read_lock();\n \t\t\t\tdest_dst = rcu_dereference(dest->dest_dst);\n \t\t\t\tif (dest_dst)\n \t\t\t\t\tmtu = dst_mtu(dest_dst->dst_cache);\n-\t\t\t\trcu_read_unlock();\n \t\t\t}\n \t\t\tif (mtu > 68 + sizeof(struct iphdr))\n \t\t\t\tmtu -= sizeof(struct iphdr);\ndiff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c\nindex 1fa3c2307b6e..4f940d7eb2f7 100644\n--- a/net/netfilter/ipvs/ip_vs_ctl.c\n+++ b/net/netfilter/ipvs/ip_vs_ctl.c\n@@ -550,18 +550,15 @@ bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,\n \t/* Check for \"full\" addressed entries */\n \thash = ip_vs_rs_hashkey(af, daddr, dport);\n \n-\trcu_read_lock();\n \thlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {\n \t\tif (dest->port == dport &&\n \t\t    dest->af == af &&\n \t\t    ip_vs_addr_equal(af, &dest->addr, daddr) &&\n \t\t    (dest->protocol == protocol || dest->vfwmark)) {\n \t\t\t/* HIT */\n-\t\t\trcu_read_unlock();\n \t\t\treturn true;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \n \treturn false;\n }\ndiff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c\nindex fb780be76d15..3e17d32b629d 100644\n--- a/net/netfilter/ipvs/ip_vs_ftp.c\n+++ b/net/netfilter/ipvs/ip_vs_ftp.c\n@@ -269,13 +269,11 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,\n \t\t\t * hopefully it will succeed on the retransmitted\n \t\t\t * packet.\n \t\t\t */\n-\t\t\trcu_read_lock();\n \t\t\tmangled = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,\n \t\t\t\t\t\t\t   iph->ihl * 4,\n \t\t\t\t\t\t\t   start - data,\n \t\t\t\t\t\t\t   end - start,\n \t\t\t\t\t\t\t   buf, buf_len);\n-\t\t\trcu_read_unlock();\n \t\t\tif (mangled) {\n \t\t\t\tip_vs_nfct_expect_related(skb, ct, n_cp,\n \t\t\t\t\t\t\t  IPPROTO_TCP, 0, 0);\ndiff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c\nindex 3ffad4adaddf..e1efa446b305 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c\n@@ -38,7 +38,6 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\treturn 0;\n \t}\n \n-\trcu_read_lock();\n \tif (likely(!ip_vs_iph_inverse(iph)))\n \t\tsvc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,\n \t\t\t\t\t &iph->daddr, ports[1]);\n@@ -53,7 +52,6 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t * It seems that we are very loaded.\n \t\t\t * We have to drop this packet :(\n \t\t\t */\n-\t\t\trcu_read_unlock();\n \t\t\t*verdict = NF_DROP;\n \t\t\treturn 0;\n \t\t}\n@@ -67,11 +65,9 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t\t*verdict = ip_vs_leave(svc, skb, pd, iph);\n \t\t\telse\n \t\t\t\t*verdict = NF_DROP;\n-\t\t\trcu_read_unlock();\n \t\t\treturn 0;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \t/* NF_ACCEPT */\n \treturn 1;\n }\n@@ -526,12 +522,10 @@ static int sctp_app_conn_bind(struct ip_vs_conn *cp)\n \t/* Lookup application incarnations and bind the right one */\n \thash = sctp_app_hashkey(cp->vport);\n \n-\trcu_read_lock();\n \tlist_for_each_entry_rcu(inc, &ipvs->sctp_apps[hash], p_list) {\n \t\tif (inc->port == cp->vport) {\n \t\t\tif (unlikely(!ip_vs_app_inc_get(inc)))\n \t\t\t\tbreak;\n-\t\t\trcu_read_unlock();\n \n \t\t\tIP_VS_DBG_BUF(9, \"%s: Binding conn %s:%u->\"\n \t\t\t\t\t\"%s:%u to app %s on port %u\\n\",\n@@ -544,11 +538,10 @@ static int sctp_app_conn_bind(struct ip_vs_conn *cp)\n \t\t\tcp->app = inc;\n \t\t\tif (inc->init_conn)\n \t\t\t\tresult = inc->init_conn(inc, cp);\n-\t\t\tgoto out;\n+\t\t\tbreak;\n \t\t}\n \t}\n-\trcu_read_unlock();\n-out:\n+\n \treturn result;\n }\n \ndiff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c\nindex 12dc8d5bc37d..121a321b91be 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c\n@@ -63,7 +63,6 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t}\n \n \t/* No !th->ack check to allow scheduling on SYN+ACK for Active FTP */\n-\trcu_read_lock();\n \n \tif (likely(!ip_vs_iph_inverse(iph)))\n \t\tsvc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,\n@@ -80,7 +79,6 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t * It seems that we are very loaded.\n \t\t\t * We have to drop this packet :(\n \t\t\t */\n-\t\t\trcu_read_unlock();\n \t\t\t*verdict = NF_DROP;\n \t\t\treturn 0;\n \t\t}\n@@ -95,11 +93,9 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t\t*verdict = ip_vs_leave(svc, skb, pd, iph);\n \t\t\telse\n \t\t\t\t*verdict = NF_DROP;\n-\t\t\trcu_read_unlock();\n \t\t\treturn 0;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \t/* NF_ACCEPT */\n \treturn 1;\n }\n@@ -661,12 +657,10 @@ tcp_app_conn_bind(struct ip_vs_conn *cp)\n \t/* Lookup application incarnations and bind the right one */\n \thash = tcp_app_hashkey(cp->vport);\n \n-\trcu_read_lock();\n \tlist_for_each_entry_rcu(inc, &ipvs->tcp_apps[hash], p_list) {\n \t\tif (inc->port == cp->vport) {\n \t\t\tif (unlikely(!ip_vs_app_inc_get(inc)))\n \t\t\t\tbreak;\n-\t\t\trcu_read_unlock();\n \n \t\t\tIP_VS_DBG_BUF(9, \"%s(): Binding conn %s:%u->\"\n \t\t\t\t      \"%s:%u to app %s on port %u\\n\",\n@@ -680,12 +674,10 @@ tcp_app_conn_bind(struct ip_vs_conn *cp)\n \t\t\tcp->app = inc;\n \t\t\tif (inc->init_conn)\n \t\t\t\tresult = inc->init_conn(inc, cp);\n-\t\t\tgoto out;\n+\t\t\tbreak;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \n-  out:\n \treturn result;\n }\n \ndiff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c\nindex e494e9a88c7f..30e11cd6aa8a 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_udp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c\n@@ -53,7 +53,6 @@ udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\treturn 0;\n \t}\n \n-\trcu_read_lock();\n \tif (likely(!ip_vs_iph_inverse(iph)))\n \t\tsvc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,\n \t\t\t\t\t &iph->daddr, ports[1]);\n@@ -69,7 +68,6 @@ udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t * It seems that we are very loaded.\n \t\t\t * We have to drop this packet :(\n \t\t\t */\n-\t\t\trcu_read_unlock();\n \t\t\t*verdict = NF_DROP;\n \t\t\treturn 0;\n \t\t}\n@@ -84,11 +82,9 @@ udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n \t\t\t\t*verdict = ip_vs_leave(svc, skb, pd, iph);\n \t\t\telse\n \t\t\t\t*verdict = NF_DROP;\n-\t\t\trcu_read_unlock();\n \t\t\treturn 0;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \t/* NF_ACCEPT */\n \treturn 1;\n }\n@@ -410,12 +406,10 @@ static int udp_app_conn_bind(struct ip_vs_conn *cp)\n \t/* Lookup application incarnations and bind the right one */\n \thash = udp_app_hashkey(cp->vport);\n \n-\trcu_read_lock();\n \tlist_for_each_entry_rcu(inc, &ipvs->udp_apps[hash], p_list) {\n \t\tif (inc->port == cp->vport) {\n \t\t\tif (unlikely(!ip_vs_app_inc_get(inc)))\n \t\t\t\tbreak;\n-\t\t\trcu_read_unlock();\n \n \t\t\tIP_VS_DBG_BUF(9, \"%s(): Binding conn %s:%u->\"\n \t\t\t\t      \"%s:%u to app %s on port %u\\n\",\n@@ -429,12 +423,10 @@ static int udp_app_conn_bind(struct ip_vs_conn *cp)\n \t\t\tcp->app = inc;\n \t\t\tif (inc->init_conn)\n \t\t\t\tresult = inc->init_conn(inc, cp);\n-\t\t\tgoto out;\n+\t\t\tbreak;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \n-  out:\n \treturn result;\n }\n \ndiff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c\nindex 2eab1e0400f4..90d396814798 100644\n--- a/net/netfilter/ipvs/ip_vs_xmit.c\n+++ b/net/netfilter/ipvs/ip_vs_xmit.c\n@@ -678,7 +678,6 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tif (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr,\n \t\t\t       IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0)\n \t\tgoto tx_error;\n@@ -689,14 +688,12 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \tip_vs_send_or_cont(NFPROTO_IPV4, skb, cp, 0);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n \n  tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -710,7 +707,6 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tif (__ip_vs_get_out_rt_v6(cp->ipvs, cp->af, skb, NULL,\n \t\t\t\t  &iph->daddr, NULL,\n \t\t\t\t  ipvsh, 0, IP_VS_RT_MODE_NON_LOCAL) < 0)\n@@ -720,14 +716,12 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \tip_vs_send_or_cont(NFPROTO_IPV6, skb, cp, 0);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n \n  tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -746,7 +740,6 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \t/* check if it is a connection of no-client-port */\n \tif (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {\n \t\t__be16 _pt, *p;\n@@ -815,14 +808,12 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \trc = ip_vs_nat_send_or_cont(NFPROTO_IPV4, skb, cp, local);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn rc;\n \n   tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -837,7 +828,6 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \t/* check if it is a connection of no-client-port */\n \tif (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT && !ipvsh->fragoffs)) {\n \t\t__be16 _pt, *p;\n@@ -906,7 +896,6 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \trc = ip_vs_nat_send_or_cont(NFPROTO_IPV6, skb, cp, local);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn rc;\n@@ -914,7 +903,6 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n tx_error:\n \tLeaveFunction(10);\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \treturn NF_STOLEN;\n }\n #endif\n@@ -1035,7 +1023,6 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt(ipvs, cp->af, skb, cp->dest, cp->daddr.ip,\n \t\t\t\t   IP_VS_RT_MODE_LOCAL |\n \t\t\t\t   IP_VS_RT_MODE_NON_LOCAL |\n@@ -1043,10 +1030,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \t\t\t\t   IP_VS_RT_MODE_TUNNEL, &saddr, ipvsh);\n \tif (local < 0)\n \t\tgoto tx_error;\n-\tif (local) {\n-\t\trcu_read_unlock();\n+\tif (local)\n \t\treturn ip_vs_send_or_cont(NFPROTO_IPV4, skb, cp, 1);\n-\t}\n \n \trt = skb_rtable(skb);\n \ttdev = rt->dst.dev;\n@@ -1095,7 +1080,6 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \t\tip_local_out(net, skb->sk, skb);\n \telse if (ret == NF_DROP)\n \t\tkfree_skb(skb);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \n@@ -1104,7 +1088,6 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n   tx_error:\n \tif (!IS_ERR(skb))\n \t\tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -1127,7 +1110,6 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt_v6(cp->ipvs, cp->af, skb, cp->dest,\n \t\t\t\t      &cp->daddr.in6,\n \t\t\t\t      &saddr, ipvsh, 1,\n@@ -1136,10 +1118,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \t\t\t\t      IP_VS_RT_MODE_TUNNEL);\n \tif (local < 0)\n \t\tgoto tx_error;\n-\tif (local) {\n-\t\trcu_read_unlock();\n+\tif (local)\n \t\treturn ip_vs_send_or_cont(NFPROTO_IPV6, skb, cp, 1);\n-\t}\n \n \trt = (struct rt6_info *) skb_dst(skb);\n \ttdev = rt->dst.dev;\n@@ -1185,7 +1165,6 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \t\tip6_local_out(cp->ipvs->net, skb->sk, skb);\n \telse if (ret == NF_DROP)\n \t\tkfree_skb(skb);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \n@@ -1194,7 +1173,6 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n tx_error:\n \tif (!IS_ERR(skb))\n \t\tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -1213,17 +1191,14 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt(cp->ipvs, cp->af, skb, cp->dest, cp->daddr.ip,\n \t\t\t\t   IP_VS_RT_MODE_LOCAL |\n \t\t\t\t   IP_VS_RT_MODE_NON_LOCAL |\n \t\t\t\t   IP_VS_RT_MODE_KNOWN_NH, NULL, ipvsh);\n \tif (local < 0)\n \t\tgoto tx_error;\n-\tif (local) {\n-\t\trcu_read_unlock();\n+\tif (local)\n \t\treturn ip_vs_send_or_cont(NFPROTO_IPV4, skb, cp, 1);\n-\t}\n \n \tip_send_check(ip_hdr(skb));\n \n@@ -1231,14 +1206,12 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \tip_vs_send_or_cont(NFPROTO_IPV4, skb, cp, 0);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n \n   tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -1252,7 +1225,6 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \n \tEnterFunction(10);\n \n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt_v6(cp->ipvs, cp->af, skb, cp->dest,\n \t\t\t\t      &cp->daddr.in6,\n \t\t\t\t      NULL, ipvsh, 0,\n@@ -1261,23 +1233,19 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \t\t\t\t      IP_VS_RT_MODE_KNOWN_NH);\n \tif (local < 0)\n \t\tgoto tx_error;\n-\tif (local) {\n-\t\trcu_read_unlock();\n+\tif (local)\n \t\treturn ip_vs_send_or_cont(NFPROTO_IPV6, skb, cp, 1);\n-\t}\n \n \t/* Another hack: avoid icmp_send in ip_fragment */\n \tskb->ignore_df = 1;\n \n \tip_vs_send_or_cont(NFPROTO_IPV6, skb, cp, 0);\n-\trcu_read_unlock();\n \n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n \n tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \tLeaveFunction(10);\n \treturn NF_STOLEN;\n }\n@@ -1322,7 +1290,6 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \trt_mode = (hooknum != NF_INET_FORWARD) ?\n \t\t  IP_VS_RT_MODE_LOCAL | IP_VS_RT_MODE_NON_LOCAL |\n \t\t  IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;\n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt(cp->ipvs, cp->af, skb, cp->dest, cp->daddr.ip, rt_mode,\n \t\t\t\t   NULL, iph);\n \tif (local < 0)\n@@ -1368,12 +1335,10 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \trc = ip_vs_nat_send_or_cont(NFPROTO_IPV4, skb, cp, local);\n-\trcu_read_unlock();\n \tgoto out;\n \n   tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \trc = NF_STOLEN;\n   out:\n \tLeaveFunction(10);\n@@ -1414,7 +1379,6 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \trt_mode = (hooknum != NF_INET_FORWARD) ?\n \t\t  IP_VS_RT_MODE_LOCAL | IP_VS_RT_MODE_NON_LOCAL |\n \t\t  IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;\n-\trcu_read_lock();\n \tlocal = __ip_vs_get_out_rt_v6(cp->ipvs, cp->af, skb, cp->dest,\n \t\t\t\t      &cp->daddr.in6, NULL, ipvsh, 0, rt_mode);\n \tif (local < 0)\n@@ -1460,12 +1424,10 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,\n \tskb->ignore_df = 1;\n \n \trc = ip_vs_nat_send_or_cont(NFPROTO_IPV6, skb, cp, local);\n-\trcu_read_unlock();\n \tgoto out;\n \n tx_error:\n \tkfree_skb(skb);\n-\trcu_read_unlock();\n \trc = NF_STOLEN;\n out:\n \tLeaveFunction(10);\ndiff --git a/net/netfilter/nf_conntrack_broadcast.c b/net/netfilter/nf_conntrack_broadcast.c\nindex 4e99cca61612..ecc3ab784633 100644\n--- a/net/netfilter/nf_conntrack_broadcast.c\n+++ b/net/netfilter/nf_conntrack_broadcast.c\n@@ -40,7 +40,6 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb,\n \tif (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)\n \t\tgoto out;\n \n-\trcu_read_lock();\n \tin_dev = __in_dev_get_rcu(rt->dst.dev);\n \tif (in_dev != NULL) {\n \t\tfor_primary_ifa(in_dev) {\n@@ -50,7 +49,6 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb,\n \t\t\t}\n \t\t} endfor_ifa(in_dev);\n \t}\n-\trcu_read_unlock();\n \n \tif (mask == 0)\n \t\tgoto out;\ndiff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c\nindex 9979f46c81dc..69746928cc0a 100644\n--- a/net/netfilter/nf_conntrack_core.c\n+++ b/net/netfilter/nf_conntrack_core.c\n@@ -407,13 +407,10 @@ destroy_conntrack(struct nf_conntrack *nfct)\n \t\tnf_ct_tmpl_free(ct);\n \t\treturn;\n \t}\n-\trcu_read_lock();\n \tl4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));\n \tif (l4proto->destroy)\n \t\tl4proto->destroy(ct);\n \n-\trcu_read_unlock();\n-\n \tlocal_bh_disable();\n \t/* Expectations will have been removed in clean_from_lists,\n \t * except TFTP can create an expectation on the first packet,\ndiff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c\nindex 7999e70c3bfb..4dba71de4de7 100644\n--- a/net/netfilter/nf_conntrack_netlink.c\n+++ b/net/netfilter/nf_conntrack_netlink.c\n@@ -539,13 +539,11 @@ static inline size_t ctnetlink_proto_size(const struct nf_conn *ct)\n \tstruct nf_conntrack_l4proto *l4proto;\n \tsize_t len = 0;\n \n-\trcu_read_lock();\n \tl3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));\n \tlen += l3proto->nla_size;\n \n \tl4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));\n \tlen += l4proto->nla_size;\n-\trcu_read_unlock();\n \n \treturn len;\n }\n@@ -664,7 +662,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)\n \tnfmsg->version\t= NFNETLINK_V0;\n \tnfmsg->res_id\t= 0;\n \n-\trcu_read_lock();\n \tzone = nf_ct_zone(ct);\n \n \tnest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);\n@@ -736,8 +733,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)\n \t    && ctnetlink_dump_mark(skb, ct) < 0)\n \t\tgoto nla_put_failure;\n #endif\n-\trcu_read_unlock();\n-\n \tnlmsg_end(skb, nlh);\n \terr = nfnetlink_send(skb, net, item->portid, group, item->report,\n \t\t\t     GFP_ATOMIC);\n@@ -747,7 +742,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)\n \treturn 0;\n \n nla_put_failure:\n-\trcu_read_unlock();\n \tnlmsg_cancel(skb, nlh);\n nlmsg_failure:\n \tkfree_skb(skb);\n@@ -2213,7 +2207,6 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)\n \tconst struct nf_conntrack_zone *zone;\n \tstruct nlattr *nest_parms;\n \n-\trcu_read_lock();\n \tzone = nf_ct_zone(ct);\n \n \tnest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);\n@@ -2272,11 +2265,9 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)\n #endif\n \tif (ctnetlink_dump_labels(skb, ct) < 0)\n \t\tgoto nla_put_failure;\n-\trcu_read_unlock();\n \treturn 0;\n \n nla_put_failure:\n-\trcu_read_unlock();\n \treturn -ENOSPC;\n }\n \n@@ -2661,17 +2652,14 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)\n \tnfmsg->version\t    = NFNETLINK_V0;\n \tnfmsg->res_id\t    = 0;\n \n-\trcu_read_lock();\n \tif (ctnetlink_exp_dump_expect(skb, exp) < 0)\n \t\tgoto nla_put_failure;\n-\trcu_read_unlock();\n \n \tnlmsg_end(skb, nlh);\n \tnfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);\n \treturn 0;\n \n nla_put_failure:\n-\trcu_read_unlock();\n \tnlmsg_cancel(skb, nlh);\n nlmsg_failure:\n \tkfree_skb(skb);\ndiff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c\nindex 6959e93063d4..11562f2a08bb 100644\n--- a/net/netfilter/nf_conntrack_pptp.c\n+++ b/net/netfilter/nf_conntrack_pptp.c\n@@ -113,7 +113,6 @@ static void pptp_expectfn(struct nf_conn *ct,\n \t/* Can you see how rusty this code is, compared with the pre-2.6.11\n \t * one? That's what happened to my shiny newnat of 2002 ;( -HW */\n \n-\trcu_read_lock();\n \tnf_nat_pptp_expectfn = rcu_dereference(nf_nat_pptp_hook_expectfn);\n \tif (nf_nat_pptp_expectfn && ct->master->status & IPS_NAT_MASK)\n \t\tnf_nat_pptp_expectfn(ct, exp);\n@@ -136,7 +135,6 @@ static void pptp_expectfn(struct nf_conn *ct,\n \t\t\tpr_debug(\"not found\\n\");\n \t\t}\n \t}\n-\trcu_read_unlock();\n }\n \n static int destroy_sibling_or_exp(struct net *net, struct nf_conn *ct,\ndiff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c\nindex d38af4274335..4dbb5bad4363 100644\n--- a/net/netfilter/nf_conntrack_sip.c\n+++ b/net/netfilter/nf_conntrack_sip.c\n@@ -884,7 +884,6 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,\n \ttuple.dst.u3\t\t= *daddr;\n \ttuple.dst.u.udp.port\t= port;\n \n-\trcu_read_lock();\n \tdo {\n \t\texp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);\n \n@@ -918,10 +917,8 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,\n \t\t\tgoto err1;\n \t}\n \n-\tif (skip_expect) {\n-\t\trcu_read_unlock();\n+\tif (skip_expect)\n \t\treturn NF_ACCEPT;\n-\t}\n \n \trtp_exp = nf_ct_expect_alloc(ct);\n \tif (rtp_exp == NULL)\n@@ -952,7 +949,6 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,\n err2:\n \tnf_ct_expect_put(rtp_exp);\n err1:\n-\trcu_read_unlock();\n \treturn ret;\n }\n \ndiff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c\nindex 400e9ae97153..7ce9e86d374c 100644\n--- a/net/netfilter/nfnetlink_cttimeout.c\n+++ b/net/netfilter/nfnetlink_cttimeout.c\n@@ -505,7 +505,6 @@ ctnl_timeout_find_get(struct net *net, const char *name)\n {\n \tstruct ctnl_timeout *timeout, *matching = NULL;\n \n-\trcu_read_lock();\n \tlist_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {\n \t\tif (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)\n \t\t\tcontinue;\n@@ -521,7 +520,6 @@ ctnl_timeout_find_get(struct net *net, const char *name)\n \t\tbreak;\n \t}\n err:\n-\trcu_read_unlock();\n \treturn matching;\n }\n \ndiff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c\nindex 16fa04086880..7c543bfbf624 100644\n--- a/net/netfilter/nfnetlink_queue.c\n+++ b/net/netfilter/nfnetlink_queue.c\n@@ -928,7 +928,6 @@ static unsigned int nfqnl_nf_hook_drop(struct net *net)\n \tunsigned int instances = 0;\n \tint i;\n \n-\trcu_read_lock();\n \tfor (i = 0; i < INSTANCE_BUCKETS; i++) {\n \t\tstruct nfqnl_instance *inst;\n \t\tstruct hlist_head *head = &q->instance_table[i];\n@@ -938,7 +937,6 @@ static unsigned int nfqnl_nf_hook_drop(struct net *net)\n \t\t\tinstances++;\n \t\t}\n \t}\n-\trcu_read_unlock();\n \n \treturn instances;\n }\ndiff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c\nindex c64aca611ac5..9dae4d665965 100644\n--- a/net/netfilter/xt_TCPMSS.c\n+++ b/net/netfilter/xt_TCPMSS.c\n@@ -62,11 +62,9 @@ static u_int32_t tcpmss_reverse_mtu(struct net *net,\n \t\tmemset(fl6, 0, sizeof(*fl6));\n \t\tfl6->daddr = ipv6_hdr(skb)->saddr;\n \t}\n-\trcu_read_lock();\n \tai = nf_get_afinfo(family);\n \tif (ai != NULL)\n \t\tai->route(net, (struct dst_entry **)&rt, &fl, false);\n-\trcu_read_unlock();\n \n \tif (rt != NULL) {\n \t\tmtu = dst_mtu(&rt->dst);\ndiff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c\nindex d767e35fff6b..2b74f37132fc 100644\n--- a/net/netfilter/xt_TPROXY.c\n+++ b/net/netfilter/xt_TPROXY.c\n@@ -70,13 +70,11 @@ tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)\n \t\treturn user_laddr;\n \n \tladdr = 0;\n-\trcu_read_lock();\n \tindev = __in_dev_get_rcu(skb->dev);\n \tfor_primary_ifa(indev) {\n \t\tladdr = ifa->ifa_local;\n \t\tbreak;\n \t} endfor_ifa(indev);\n-\trcu_read_unlock();\n \n \treturn laddr ? laddr : daddr;\n }\n@@ -391,7 +389,6 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,\n \t\treturn user_laddr;\n \tladdr = NULL;\n \n-\trcu_read_lock();\n \tindev = __in6_dev_get(skb->dev);\n \tif (indev) {\n \t\tread_lock_bh(&indev->lock);\n@@ -404,7 +401,6 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,\n \t\t}\n \t\tread_unlock_bh(&indev->lock);\n \t}\n-\trcu_read_unlock();\n \n \treturn laddr ? laddr : daddr;\n }\ndiff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c\nindex e329dabde35f..3b2be2ae6987 100644\n--- a/net/netfilter/xt_addrtype.c\n+++ b/net/netfilter/xt_addrtype.c\n@@ -47,8 +47,6 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,\n \tif (dev)\n \t\tflow.flowi6_oif = dev->ifindex;\n \n-\trcu_read_lock();\n-\n \tafinfo = nf_get_afinfo(NFPROTO_IPV6);\n \tif (afinfo != NULL) {\n \t\tconst struct nf_ipv6_ops *v6ops;\n@@ -63,7 +61,6 @@ static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,\n \t} else {\n \t\troute_err = 1;\n \t}\n-\trcu_read_unlock();\n \n \tif (route_err)\n \t\treturn XT_ADDRTYPE_UNREACHABLE;\ndiff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c\nindex b8fd4ab762ed..97589b8a2a40 100644\n--- a/net/netfilter/xt_connlimit.c\n+++ b/net/netfilter/xt_connlimit.c\n@@ -144,7 +144,6 @@ static unsigned int check_hlist(struct net *net,\n \tunsigned int length = 0;\n \n \t*addit = true;\n-\trcu_read_lock();\n \n \t/* check the saved connections */\n \thlist_for_each_entry_safe(conn, n, head, node) {\n@@ -179,8 +178,6 @@ static unsigned int check_hlist(struct net *net,\n \t\tlength++;\n \t}\n \n-\trcu_read_unlock();\n-\n \treturn length;\n }\n \ndiff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c\nindex 762e1874f28b..ffdb611e54a2 100644\n--- a/net/netfilter/xt_hashlimit.c\n+++ b/net/netfilter/xt_hashlimit.c\n@@ -659,12 +659,12 @@ hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par,\n \tif (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)\n \t\tgoto hotdrop;\n \n-\trcu_read_lock_bh();\n+\tlocal_bh_disable();\n \tdh = dsthash_find(hinfo, &dst);\n \tif (dh == NULL) {\n \t\tdh = dsthash_alloc_init(hinfo, &dst, &race);\n \t\tif (dh == NULL) {\n-\t\t\trcu_read_unlock_bh();\n+\t\t\tlocal_bh_enable();\n \t\t\tgoto hotdrop;\n \t\t} else if (race) {\n \t\t\t/* Already got an entry, update expiration timeout */\n@@ -689,12 +689,12 @@ hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par,\n \t\t/* below the limit */\n \t\tdh->rateinfo.credit -= cost;\n \t\tspin_unlock(&dh->lock);\n-\t\trcu_read_unlock_bh();\n+\t\tlocal_bh_enable();\n \t\treturn !(cfg->mode & XT_HASHLIMIT_INVERT);\n \t}\n \n \tspin_unlock(&dh->lock);\n-\trcu_read_unlock_bh();\n+\tlocal_bh_enable();\n \t/* default match is underlimit - so over the limit, we need to invert */\n \treturn cfg->mode & XT_HASHLIMIT_INVERT;\n \ndiff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c\nindex 71cfa9551d08..36e14b1f061d 100644\n--- a/net/netfilter/xt_osf.c\n+++ b/net/netfilter/xt_osf.c\n@@ -226,7 +226,6 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)\n \t\t\t\tsizeof(struct tcphdr), optsize, opts);\n \t}\n \n-\trcu_read_lock();\n \tlist_for_each_entry_rcu(kf, &xt_osf_fingers[df], finger_entry) {\n \t\tint foptsize, optnum;\n \n@@ -340,7 +339,6 @@ xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)\n \t\t    info->loglevel == XT_OSF_LOGLEVEL_FIRST)\n \t\t\tbreak;\n \t}\n-\trcu_read_unlock();\n \n \tif (!fcount && (info->flags & XT_OSF_LOG))\n \t\tnf_log_packet(net, xt_family(p), xt_hooknum(p), skb, xt_in(p),\n",
    "prefixes": [
        "03/47"
    ]
}