[NET]: Fix the race between sk_filter_(de|at)tach and sk_clone()

[linux-2.6] / include / net / sock.h

diff --git a/include/net/sock.h b/include/net/sock.h
index 453c79d0915ba00ca8b33ff160ba64cb7c58a521..43fc3fa50d6237227e5bec82bc0b4e8e0d4ce8b7 100644 (file)
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -904,16 +904,6 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
        return err;
 }
 
-/**
- *     sk_filter_rcu_free: Free a socket filter
- *     @rcu: rcu_head that contains the sk_filter to free
- */
-static inline void sk_filter_rcu_free(struct rcu_head *rcu)
-{
-       struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
-       kfree(fp);
-}
-
 /**
  *     sk_filter_release: Release a socket filter
  *     @sk: socket
@@ -922,14 +912,18 @@ static inline void sk_filter_rcu_free(struct rcu_head *rcu)
  *     Remove a filter from a socket and release its resources.
  */
 
-static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
+static inline void sk_filter_release(struct sk_filter *fp)
+{
+       if (atomic_dec_and_test(&fp->refcnt))
+               kfree(fp);
+}
+
+static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
 {
        unsigned int size = sk_filter_len(fp);
 
        atomic_sub(size, &sk->sk_omem_alloc);
-
-       if (atomic_dec_and_test(&fp->refcnt))
-               call_rcu_bh(&fp->rcu, sk_filter_rcu_free);
+       sk_filter_release(fp);
 }
 
 static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)