From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Miller <davem@davemloft.net>
Subject: Re: [Patch net] llc: hold llc_sap before release_sock()
Date: Thu, 19 Apr 2018 13:54:40 -0400 (EDT)
Message-ID: <20180419.135440.1073794971834587664.davem@davemloft.net>
References: <20180418185156.27067-1-xiyou.wangcong@gmail.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org
To: xiyou.wangcong@gmail.com
Return-path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([184.105.139.130]:33016 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752804AbeDSRyl (ORCPT
        <rfc822;netdev@vger.kernel.org>); Thu, 19 Apr 2018 13:54:41 -0400
In-Reply-To: <20180418185156.27067-1-xiyou.wangcong@gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Wed, 18 Apr 2018 11:51:56 -0700

> @@ -199,9 +200,15 @@ static int llc_ui_release(struct socket *sock)
>  		llc->laddr.lsap, llc->daddr.lsap);
>  	if (!llc_send_disc(sk))
>  		llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
> +	sap = llc->sap;
> +	/* Hold this for release_sock(), so that llc_backlog_rcv() could still
> +	 * use it.
> +	 */
> +	llc_sap_hold(sap);
>  	if (!sock_flag(sk, SOCK_ZAPPED))
>  		llc_sap_remove_socket(llc->sap, sk);
>  	release_sock(sk);
> +	llc_sap_put(sap);
>  	if (llc->dev)
>  		dev_put(llc->dev);
>  	sock_put(sk);

Yeah, kind of a weird ordering issue here.  It would have been nice if we could
remove the sap after the release_sock() but it appears that we can't.

Applied and queued up for -stable, thanks.