tree bebfe86ae36055adae2100200e87727d21a7b762
parent 13475a30b66cdb9250a34052c19ac98847373030
author Eric Dumazet <eric.dumazet@gmail.com> 1259801341 +0000
committer David S. Miller <davem@davemloft.net> 1259885864 -0800

tcp: fix a timewait refcnt race

After TCP RCU conversion, tw->tw_refcnt should not be set to 1 in
inet_twsk_alloc(). It allows a RCU reader to get this timewait socket,
while we not yet stabilized it.

Only choice we have is to set tw_refcnt to 0 in inet_twsk_alloc(),
then atomic_add() it later, once everything is done.

Location of this atomic_add() is tricky, because we dont want another
writer to find this timewait in ehash, while tw_refcnt is still zero !

Thanks to Kapil Dakhane tests and reports.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>