net: ipv4: Fix a spinlock recursion bug in tcp_v4_nuke.

We can't hold the lock while calling to tcp_done(), so we drop
it before calling. We then have to start at the top of the chain again.

Signed-off-by: Dima Zavin <dima@android.com>

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7c05a50..b04e5ad 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1865,6 +1865,7 @@ void tcp_v4_nuke_addr(__u32 saddr)
                struct sock *sk;
                spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, bucket);
 
+restart:
                spin_lock_bh(lock);
                sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[bucket].chain) {
                        struct inet_sock *inet = inet_sk(sk);
@@ -1878,7 +1879,9 @@ void tcp_v4_nuke_addr(__u32 saddr)
 
                        sk->sk_err = ETIMEDOUT;
                        sk->sk_error_report(sk);
+                       spin_unlock_bh(lock);
                        tcp_done(sk);
+                       goto restart;
                }
                spin_unlock_bh(lock);
        }