Writers are holding a lock, but many readers do not.
Following patch will add appropriate barriers in
sk_acceptq_removed() and sk_acceptq_added().
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
                        dev_kfree_skb(skb);
                        goto as_indicate_complete;
                }
-               sk->sk_ack_backlog++;
+               sk_acceptq_added(sk);
                skb_queue_tail(&sk->sk_receive_queue, skb);
                pr_debug("waking sk_sleep(sk) 0x%p\n", sk_sleep(sk));
                sk->sk_state_change(sk);
 
                                    msg->pvc.sap_addr.vpi,
                                    msg->pvc.sap_addr.vci);
                dev_kfree_skb(skb);
-               sk->sk_ack_backlog--;
+               sk_acceptq_removed(sk);
                if (error) {
                        sigd_enq2(NULL, as_reject, old_vcc, NULL, NULL,
                                  &old_vcc->qos, error);
 
 
        /* Now attach up the new socket */
        kfree_skb(skb);
-       sk->sk_ack_backlog--;
+       sk_acceptq_removed(sk);
        newsock->state = SS_CONNECTED;
 
 out:
 
 
                make->sk_state = TCP_ESTABLISHED;
 
-               sk->sk_ack_backlog++;
+               sk_acceptq_added(sk);
                bh_unlock_sock(sk);
        } else {
                if (!mine)
 
        else
                release_sock(sk);
 
-       parent->sk_ack_backlog++;
+       sk_acceptq_added(parent);
 }
 EXPORT_SYMBOL(bt_accept_enqueue);
 
        BT_DBG("sk %p state %d", sk, sk->sk_state);
 
        list_del_init(&bt_sk(sk)->accept_q);
-       bt_sk(sk)->parent->sk_ack_backlog--;
+       sk_acceptq_removed(bt_sk(sk)->parent);
        bt_sk(sk)->parent = NULL;
        sock_put(sk);
 }
 
        }
 
        cb = DN_SKB_CB(skb);
-       sk->sk_ack_backlog--;
+       sk_acceptq_removed(sk);
        newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, kern);
        if (newsk == NULL) {
                release_sock(sk);
 
                return;
        }
 
-       sk->sk_ack_backlog++;
+       sk_acceptq_added(sk);
        skb_queue_tail(&sk->sk_receive_queue, skb);
        sk->sk_state_change(sk);
 }
 
 
        /* put original socket back into a clean listen state. */
        sk->sk_state = TCP_LISTEN;
-       sk->sk_ack_backlog--;
+       sk_acceptq_removed(sk);
        dprintk("%s: ok success on %02X, client on %02X\n", __func__,
                llc_sk(sk)->addr.sllc_sap, newllc->daddr.lsap);
 frees:
 
        /* Now attach up the new socket */
        skb->sk = NULL;
        kfree_skb(skb);
-       sk->sk_ack_backlog--;
+       sk_acceptq_removed(sk);
 
 out_release:
        release_sock(sk);
        make_rose->va        = 0;
        make_rose->vr        = 0;
        make_rose->vl        = 0;
-       sk->sk_ack_backlog++;
+       sk_acceptq_added(sk);
 
        rose_insert_socket(make);
 
 
                 * socket.
                 */
                if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
-                       sk->sk_ack_backlog--;
+                       sk_acceptq_removed(sk);
        }
 
        /* Mark as dead, so other users can know this structure is
 
        /* Decrement the backlog value for a TCP-style socket. */
        if (sctp_style(oldsk, TCP))
-               oldsk->sk_ack_backlog--;
+               sk_acceptq_removed(oldsk);
 
        /* Release references to the old endpoint and the sock.  */
        sctp_endpoint_put(assoc->ep);
 
 
        /* Increment the backlog value for a TCP-style listening socket. */
        if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
-               sk->sk_ack_backlog++;
+               sk_acceptq_added(sk);
 }
 
 /* Free the endpoint structure.  Delay cleanup until
 
        if (vsock_is_pending(sk)) {
                vsock_remove_pending(listener, sk);
 
-               listener->sk_ack_backlog--;
+               sk_acceptq_removed(listener);
        } else if (!vsk->rejected) {
                /* We are not on the pending list and accept() did not reject
                 * us, so we must have been accepted by our user process.  We
                err = -listener->sk_err;
 
        if (connected) {
-               listener->sk_ack_backlog--;
+               sk_acceptq_removed(listener);
 
                lock_sock_nested(connected, SINGLE_DEPTH_NESTING);
                vconnected = vsock_sk(connected);
 
 
        if (conn_from_host) {
                new->sk_state = TCP_ESTABLISHED;
-               sk->sk_ack_backlog++;
+               sk_acceptq_added(sk);
 
                hvs_addr_init(&vnew->local_addr, if_type);
                hvs_remote_addr_init(&vnew->remote_addr, &vnew->local_addr);
 
                return -ENOMEM;
        }
 
-       sk->sk_ack_backlog++;
+       sk_acceptq_added(sk);
 
        lock_sock_nested(child, SINGLE_DEPTH_NESTING);
 
 
        }
 
        vsock_add_pending(sk, pending);
-       sk->sk_ack_backlog++;
+       sk_acceptq_added(sk);
 
        pending->sk_state = TCP_SYN_SENT;
        vmci_trans(vpending)->produce_size =
 
        /* Now attach up the new socket */
        skb->sk = NULL;
        kfree_skb(skb);
-       sk->sk_ack_backlog--;
+       sk_acceptq_removed(sk);
        newsock->state = SS_CONNECTED;
        rc = 0;
 out2:
        skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
        makex25->calluserdata.cudlength = skb->len;
 
-       sk->sk_ack_backlog++;
+       sk_acceptq_added(sk);
 
        x25_insert_socket(make);