From: Jonathan Lemon Subject: [PATCH net-next] net: Set tw refcount before dropping the ehash chain lock. Date: Thu, 20 Dec 2018 12:59:08 -0800 Message-ID: <20181220205908.1056118-1-jonathan.lemon@gmail.com> Mime-Version: 1.0 Content-Type: text/plain Cc: , , , Jonathan Lemon To: Return-path: Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:56370 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729539AbeLTU7b (ORCPT ); Thu, 20 Dec 2018 15:59:31 -0500 Received: from pps.filterd (m0148461.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id wBKKvWEt027081 for ; Thu, 20 Dec 2018 12:59:31 -0800 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2pgjfkg0ws-14 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Thu, 20 Dec 2018 12:59:31 -0800 Sender: netdev-owner@vger.kernel.org List-ID: This protects against callers like inet_diag_dump_icsk(), which may walk the chain on another cpu and change the refcount before the tw structure is ready. Signed-off-by: Jonathan Lemon --- net/ipv4/inet_timewait_sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index 88c5069b5d20..128cfcada5e6 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -125,8 +125,6 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, if (__sk_nulls_del_node_init_rcu(sk)) sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); - spin_unlock(lock); - /* tw_refcnt is set to 3 because we have : * - one reference for bhash chain. * - one reference for ehash chain. @@ -137,6 +135,8 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, * so we are not allowed to use tw anymore. */ refcount_set(&tw->tw_refcnt, 3); + + spin_unlock(lock); } EXPORT_SYMBOL_GPL(inet_twsk_hashdance); -- 2.17.1