inet: fix races with reqsk timers

This change “inet: fix races with reqsk timers” in Linux kernel is authored by Eric Dumazet <edumazet [at]> on Mon Aug 10 09:09:13 2015 -0700.

inet: fix races with reqsk timers

reqsk_queue_destroy() and reqsk_queue_unlink() should use
del_timer_sync() instead of del_timer() before calling reqsk_put(),
otherwise we could free a req still used by another cpu.

But before doing so, reqsk_queue_destroy() must release syn_wait_lock
spinlock or risk a dead lock, as reqsk_timer_handler() might
need to take this same spinlock from reqsk_queue_unlink() (called from

Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>

This Linux change may have been applied to various maintained Linux releases and you can find Linux releases including commit 2235f2a.

There are 10 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/core/request_sock.c         | 8 +++++++-
 net/ipv4/inet_connection_sock.c | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 87b22c0..b42f0e2 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
 			while ((req = lopt->syn_table[i]) != NULL) {
 				lopt->syn_table[i] = req->dl_next;
+				/* Because of following del_timer_sync(),
+				 * we must release the spinlock here
+				 * or risk a dead lock.
+				 */
+				spin_unlock_bh(&queue->syn_wait_lock);
-				if (del_timer(&req->rsk_timer))
+				if (del_timer_sync(&req->rsk_timer))
+				spin_lock_bh(&queue->syn_wait_lock);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 60021d0..05e3145 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -593,7 +593,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
-	if (del_timer(&req->rsk_timer))
+	if (del_timer_sync(&req->rsk_timer))
 	return found;

The commit for this change in Linux stable tree is 2235f2a (patch).

Leave a Reply

Your email address will not be published. Required fields are marked *