forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-05-10 37f49e37ab4cb5d0bc4c60eb5c6d4dd57db767bb 
 kernel/net/ipv6/ipv6_sockglue.c
....@@ -429,9 +429,6 @@
429429 		if (optlen < sizeof(int))
430430 			goto e_inval;
431431 		if (val == PF_INET) {
432
-			struct ipv6_txoptions *opt;
433
-			struct sk_buff *pktopt;
434
-
435432 			if (sk->sk_type == SOCK_RAW)
436433 				break;
437434 
....@@ -462,7 +459,6 @@
462459 				break;
463460 			}
464461 
465
-			fl6_free_socklist(sk);
466462 			__ipv6_sock_mc_close(sk);
467463 			__ipv6_sock_ac_close(sk);
468464 
....@@ -497,14 +493,14 @@
497493 				sk->sk_socket->ops = &inet_dgram_ops;
498494 				sk->sk_family = PF_INET;
499495 			}
500
-			opt = xchg((__force struct ipv6_txoptions **)&np->opt,
501
-				   NULL);
502
-			if (opt) {
503
-				atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
504
-				txopt_put(opt);
505
-			}
506
-			pktopt = xchg(&np->pktoptions, NULL);
507
-			kfree_skb(pktopt);
496
+
497
+			/* Disable all options not to allocate memory anymore,
498
+			 * but there is still a race.  See the lockless path
499
+			 * in udpv6_sendmsg() and ipv6_local_rxpmtu().
500
+			 */
501
+			np->rxopt.all = 0;
502
+
503
+			inet6_cleanup_sock(sk);
508504 
509505 			/*
510506 			 * ... and add it to the refcnt debug socks count