Re: [PATCH] tcp: fix possible socket refcount problem

From: Eric Dumazet <redacted>
Date: Mon, 20 Aug 2012 12:22:46 +0200

From: Eric Dumazet <edumazet@google.com>

Commit 6f458dfb40 (tcp: improve latencies of timer triggered events)
added bug leading to following trace :

 ...

The bug comes from the fact that timer set in sk_reset_timer() can run
before we actually do the sock_hold(). socket refcount reaches zero and
we free the socket too soon.

timer handler is not allowed to reduce socket refcnt if socket is owned
by the user, or we need to change sk_reset_timer() implementation.

We should take a reference on the socket in case TCP_DELACK_TIMER_DEFERRED
or TCP_DELACK_TIMER_DEFERRED bit are set in tsq_flags

Also fix a typo in tcp_delack_timer(), where TCP_WRITE_TIMER_DEFERRED
was used instead of TCP_DELACK_TIMER_DEFERRED.

For consistency, use same socket refcount change for TCP_MTU_REDUCED_DEFERRED,
even if not fired from a timer.

Reported-by: Fengguang Wu <redacted>
Tested-by: Fengguang Wu <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied, thanks Eric.