SDP: Don't allow destruct socket when having sdp_destroy_work in workqueue

in error flow, sdp_destroy_work is placed in workqueue and sometimes the
user application call close() that destruct the socket before sdp_destroy_work
is called.

Signed-off-by: Amir Vadai <amirv@mellanox.co.il>

diff --git a/drivers/infiniband/ulp/sdp/sdp_main.c b/drivers/infiniband/ulp/sdp/sdp_main.c
index c3bd9f4c686d57d326f95b5d6e97cbcd3026f815..de14ab685ad9e576f642bde787a286df1c5fe626 100644 (file)
--- a/drivers/infiniband/ulp/sdp/sdp_main.c
+++ b/drivers/infiniband/ulp/sdp/sdp_main.c
@@ -344,6 +344,8 @@ void sdp_reset_sk(struct sock *sk, int rc)
 
        sk->sk_state_change(sk);
 
+       /* Don't destroy socket before destroy work does its job */
+       sock_hold(sk);
        queue_work(sdp_workqueue, &ssk->destroy_work);
 
        read_unlock(&device_removal_lock);
@@ -855,6 +857,7 @@ void sdp_destroy_work(struct work_struct *work)
           but if a CM connection is dropped below our legs state could
           be any state */
        sdp_exch_state(sk, ~0, TCP_CLOSE);
+       sock_put(sk);
 }
 
 void sdp_dreq_wait_timeout_work(struct work_struct *work)