write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/net/sunrpc/svcsock.c
..
..
@@ -692,12 +692,6 @@
692
692
 {
693
693
 	struct svc_sock	*svsk = (struct svc_sock *)sk->sk_user_data;
694
694
 
695
-	if (svsk) {
696
-		/* Refer to svc_setup_socket() for details. */
697
-		rmb();
698
-		svsk->sk_odata(sk);
699
-	}
700
-
701
695
 	/*
702
696
 	 * This callback may called twice when a new connection
703
697
 	 * is established as a child socket inherits everything
..
..
@@ -706,13 +700,18 @@
706
700
 	 *    when one of child sockets become ESTABLISHED.
707
701
 	 * 2) data_ready method of the child socket may be called
708
702
 	 *    when it receives data before the socket is accepted.
709
-	 * In case of 2, we should ignore it silently.
703
+	 * In case of 2, we should ignore it silently and DO NOT
704
+	 * dereference svsk.
710
705
 	 */
711
-	if (sk->sk_state == TCP_LISTEN) {
712
-		if (svsk) {
713
-			set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
714
-			svc_xprt_enqueue(&svsk->sk_xprt);
715
-		}
706
+	if (sk->sk_state != TCP_LISTEN)
707
+		return;
708
+
709
+	if (svsk) {
710
+		/* Refer to svc_setup_socket() for details. */
711
+		rmb();
712
+		svsk->sk_odata(sk);
713
+		set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
714
+		svc_xprt_enqueue(&svsk->sk_xprt);
716
715
 	}
717
716
 }
718
717