Messages in this thread | | | Date | Fri, 11 Sep 2009 11:43:37 -0700 (PDT) | Subject | Re: [PATCH] net: Fix sock_wfree() race | From | David Miller <> |
| |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Wed, 09 Sep 2009 00:49:31 +0200
> [PATCH] net: Fix sock_wfree() race > > Commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 > (net: No more expensive sock_hold()/sock_put() on each tx) > opens a window in sock_wfree() where another cpu > might free the socket we are working on. > > Fix is to call sk->sk_write_space(sk) only > while still holding a reference on sk. > > Since doing this call is done before the > atomic_sub(truesize, &sk->sk_wmem_alloc), we should pass truesize as > a bias for possible sk_wmem_alloc evaluations. > > Reported-by: Jike Song <albcamus@gmail.com> > Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied to net-next-2.6, thanks. I'll queue up your simpler version for -stable.
BTW, if most if not all of the sock_writeable() calls are now sock_writeable_bias(), it's probably better to just add the bias argument to sock_writable().
And a quick grep shows that only a few plain sock_writeable() calls remain in the less often used protocols.
| |