Re: [PATCH] net: Fix sock_wfree() race

[David Miller <davem@davemloft.net>]

From: David Miller <davem@davemloft.net>
Date: Fri, 11 Sep 2009 11:43:37 -0700 (PDT)

> From: Eric Dumazet <eric.dumazet@gmail.com>
> Date: Wed, 09 Sep 2009 00:49:31 +0200
> 
>> [PATCH] net: Fix sock_wfree() race
>> 
>> Commit 2b85a34e911bf483c27cfdd124aeb1605145dc80
>> (net: No more expensive sock_hold()/sock_put() on each tx)
>> opens a window in sock_wfree() where another cpu
>> might free the socket we are working on.
>> 
>> Fix is to call sk->sk_write_space(sk) only
>> while still holding a reference on sk.
>> 
>> Since doing this call is done before the 
>> atomic_sub(truesize, &sk->sk_wmem_alloc), we should pass truesize as 
>> a bias for possible sk_wmem_alloc evaluations.
>> 
>> Reported-by: Jike Song <albcamus@gmail.com>
>> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> 
> Applied to net-next-2.6, thanks.  I'll queue up your simpler
> version for -stable.

Eric, I have to revert, as you didn't update the callbacks
of several protocols such as SCTP and RDS in this change.

Let me know when you have a fixed version of this patch :-)