.. | .. |
---|
32 | 32 | struct socket *sock = sk->sk_socket; |
---|
33 | 33 | struct socket_wq *wq; |
---|
34 | 34 | |
---|
35 | | - if (sk_stream_is_writeable(sk) && sock) { |
---|
| 35 | + if (__sk_stream_is_writeable(sk, 1) && sock) { |
---|
36 | 36 | clear_bit(SOCK_NOSPACE, &sock->flags); |
---|
37 | 37 | |
---|
38 | 38 | rcu_read_lock(); |
---|
.. | .. |
---|
73 | 73 | add_wait_queue(sk_sleep(sk), &wait); |
---|
74 | 74 | sk->sk_write_pending++; |
---|
75 | 75 | done = sk_wait_event(sk, timeo_p, |
---|
76 | | - !sk->sk_err && |
---|
77 | | - !((1 << sk->sk_state) & |
---|
| 76 | + !READ_ONCE(sk->sk_err) && |
---|
| 77 | + !((1 << READ_ONCE(sk->sk_state)) & |
---|
78 | 78 | ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)), &wait); |
---|
79 | 79 | remove_wait_queue(sk_sleep(sk), &wait); |
---|
80 | 80 | sk->sk_write_pending--; |
---|
.. | .. |
---|
87 | 87 | * sk_stream_closing - Return 1 if we still have things to send in our buffers. |
---|
88 | 88 | * @sk: socket to verify |
---|
89 | 89 | */ |
---|
90 | | -static inline int sk_stream_closing(struct sock *sk) |
---|
| 90 | +static int sk_stream_closing(const struct sock *sk) |
---|
91 | 91 | { |
---|
92 | | - return (1 << sk->sk_state) & |
---|
| 92 | + return (1 << READ_ONCE(sk->sk_state)) & |
---|
93 | 93 | (TCPF_FIN_WAIT1 | TCPF_CLOSING | TCPF_LAST_ACK); |
---|
94 | 94 | } |
---|
95 | 95 | |
---|
.. | .. |
---|
142 | 142 | |
---|
143 | 143 | set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); |
---|
144 | 144 | sk->sk_write_pending++; |
---|
145 | | - sk_wait_event(sk, ¤t_timeo, sk->sk_err || |
---|
146 | | - (sk->sk_shutdown & SEND_SHUTDOWN) || |
---|
| 145 | + sk_wait_event(sk, ¤t_timeo, READ_ONCE(sk->sk_err) || |
---|
| 146 | + (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN) || |
---|
147 | 147 | (sk_stream_memory_free(sk) && |
---|
148 | 148 | !vm_wait), &wait); |
---|
149 | 149 | sk->sk_write_pending--; |
---|
.. | .. |
---|
159 | 159 | *timeo_p = current_timeo; |
---|
160 | 160 | } |
---|
161 | 161 | out: |
---|
162 | | - remove_wait_queue(sk_sleep(sk), &wait); |
---|
| 162 | + if (!sock_flag(sk, SOCK_DEAD)) |
---|
| 163 | + remove_wait_queue(sk_sleep(sk), &wait); |
---|
163 | 164 | return err; |
---|
164 | 165 | |
---|
165 | 166 | do_error: |
---|
.. | .. |
---|
195 | 196 | /* First the read buffer. */ |
---|
196 | 197 | __skb_queue_purge(&sk->sk_receive_queue); |
---|
197 | 198 | |
---|
| 199 | + /* Next, the error queue. |
---|
| 200 | + * We need to use queue lock, because other threads might |
---|
| 201 | + * add packets to the queue without socket lock being held. |
---|
| 202 | + */ |
---|
| 203 | + skb_queue_purge(&sk->sk_error_queue); |
---|
| 204 | + |
---|
198 | 205 | /* Next, the write queue. */ |
---|
199 | 206 | WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); |
---|
200 | 207 | |
---|
.. | .. |
---|
202 | 209 | sk_mem_reclaim(sk); |
---|
203 | 210 | |
---|
204 | 211 | WARN_ON(sk->sk_wmem_queued); |
---|
205 | | - WARN_ON(sk->sk_forward_alloc); |
---|
206 | 212 | |
---|
207 | 213 | /* It is _impossible_ for the backlog to contain anything |
---|
208 | 214 | * when we get here. All user references to this socket |
---|