From 00fe5ecdd3cca5826464845b6301bf364a95ba0a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 9 Jun 2010 16:21:07 +0000
Subject: [PATCH] --- yaml --- r: 202703 b: refs/heads/master c:
 592fcb9dfafaa02dd0edc207bf5d3a0ee7a1f8df h: refs/heads/master i:   202701:
 61cc0e30d982ad49a9830d4cc75becf4e046d578   202699:
 1d29053149488dc82f56e490dec3d9c2ae6faa4a   202695:
 548734319f5bb5eba9aff601cf0406bd1974688a   202687:
 79eb433c91698edc91a5912f47a4fe333996f87e v: v3

---
 [refs]                       |  2 +-
 trunk/include/net/ip.h       |  5 ++++-
 trunk/net/ipv4/ip_sockglue.c | 19 +++++++++++++++----
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/[refs] b/[refs]
index adcc603e46ce..16da7e9592b8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 96b52e61be1ad4d4f8de39b9deaf253da804ea3b
+refs/heads/master: 592fcb9dfafaa02dd0edc207bf5d3a0ee7a1f8df
diff --git a/trunk/include/net/ip.h b/trunk/include/net/ip.h
index 9982c97f0bdc..d52f01180361 100644
--- a/trunk/include/net/ip.h
+++ b/trunk/include/net/ip.h
@@ -61,7 +61,10 @@ struct ipcm_cookie {
 struct ip_ra_chain {
 	struct ip_ra_chain	*next;
 	struct sock		*sk;
-	void			(*destructor)(struct sock *);
+	union {
+		void			(*destructor)(struct sock *);
+		struct sock		*saved_sk;
+	};
 	struct rcu_head		rcu;
 };
 
diff --git a/trunk/net/ipv4/ip_sockglue.c b/trunk/net/ipv4/ip_sockglue.c
index 08b9519a24f4..47fff528ff39 100644
--- a/trunk/net/ipv4/ip_sockglue.c
+++ b/trunk/net/ipv4/ip_sockglue.c
@@ -241,9 +241,13 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
 struct ip_ra_chain *ip_ra_chain;
 static DEFINE_SPINLOCK(ip_ra_lock);
 
-static void ip_ra_free_rcu(struct rcu_head *head)
+
+static void ip_ra_destroy_rcu(struct rcu_head *head)
 {
-	kfree(container_of(head, struct ip_ra_chain, rcu));
+	struct ip_ra_chain *ra = container_of(head, struct ip_ra_chain, rcu);
+
+	sock_put(ra->saved_sk);
+	kfree(ra);
 }
 
 int ip_ra_control(struct sock *sk, unsigned char on,
@@ -264,13 +268,20 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 				kfree(new_ra);
 				return -EADDRINUSE;
 			}
+			/* dont let ip_call_ra_chain() use sk again */
+			ra->sk = NULL;
 			rcu_assign_pointer(*rap, ra->next);
 			spin_unlock_bh(&ip_ra_lock);
 
 			if (ra->destructor)
 				ra->destructor(sk);
-			sock_put(sk);
-			call_rcu(&ra->rcu, ip_ra_free_rcu);
+			/*
+			 * Delay sock_put(sk) and kfree(ra) after one rcu grace
+			 * period. This guarantee ip_call_ra_chain() dont need
+			 * to mess with socket refcounts.
+			 */
+			ra->saved_sk = sk;
+			call_rcu(&ra->rcu, ip_ra_destroy_rcu);
 			return 0;
 		}
 	}