From: Amir Vadai Date: Wed, 23 Jul 2008 11:30:31 +0000 (+0300) Subject: SDP: Don't allow destruct socket when having sdp_destroy_work in workqueue X-Git-Tag: v4.1.12-92~264^2~5^2~317 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=1b0aa825e8af082fd19c7c62a5267e1998ca7e4d;p=users%2Fjedix%2Flinux-maple.git SDP: Don't allow destruct socket when having sdp_destroy_work in workqueue in error flow, sdp_destroy_work is placed in workqueue and sometimes the user application call close() that destruct the socket before sdp_destroy_work is called. Signed-off-by: Amir Vadai --- diff --git a/drivers/infiniband/ulp/sdp/sdp_main.c b/drivers/infiniband/ulp/sdp/sdp_main.c index c3bd9f4c686d5..de14ab685ad9e 100644 --- a/drivers/infiniband/ulp/sdp/sdp_main.c +++ b/drivers/infiniband/ulp/sdp/sdp_main.c @@ -344,6 +344,8 @@ void sdp_reset_sk(struct sock *sk, int rc) sk->sk_state_change(sk); + /* Don't destroy socket before destroy work does its job */ + sock_hold(sk); queue_work(sdp_workqueue, &ssk->destroy_work); read_unlock(&device_removal_lock); @@ -855,6 +857,7 @@ void sdp_destroy_work(struct work_struct *work) but if a CM connection is dropped below our legs state could be any state */ sdp_exch_state(sk, ~0, TCP_CLOSE); + sock_put(sk); } void sdp_dreq_wait_timeout_work(struct work_struct *work)