• Eric Dumazet's avatar
    inet: fix races with reqsk timers · 2235f2ac
    Eric Dumazet authored
    reqsk_queue_destroy() and reqsk_queue_unlink() should use
    del_timer_sync() instead of del_timer() before calling reqsk_put(),
    otherwise we could free a req still used by another cpu.
    
    But before doing so, reqsk_queue_destroy() must release syn_wait_lock
    spinlock or risk a dead lock, as reqsk_timer_handler() might
    need to take this same spinlock from reqsk_queue_unlink() (called from
    inet_csk_reqsk_queue_drop())
    
    Fixes: fa76ce73 ("inet: get rid of central tcp/dccp listener timer")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    2235f2ac
request_sock.c 7.3 KB