This protects against callers like inet_diag_dump_icsk(), which may walk the chain on another cpu and change the refcount before the tw structure is ready.
Signed-off-by: Jonathan Lemon <jonathan.le...@gmail.com> --- net/ipv4/inet_timewait_sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index 88c5069b5d20..128cfcada5e6 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -125,8 +125,6 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, if (__sk_nulls_del_node_init_rcu(sk)) sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); - spin_unlock(lock); - /* tw_refcnt is set to 3 because we have : * - one reference for bhash chain. * - one reference for ehash chain. @@ -137,6 +135,8 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, * so we are not allowed to use tw anymore. */ refcount_set(&tw->tw_refcnt, 3); + + spin_unlock(lock); } EXPORT_SYMBOL_GPL(inet_twsk_hashdance); -- 2.17.1