mptcp: defer freeing of cached ext until last moment

access to msk->cached_ext is only legal if the msk is locked or all
concurrent accesses are impossible.

Furthermore, once we start to tear down, we must make sure nothing else
can step in and allocate a new cached ext.

So place this code in the destroy callback where it belongs.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 39fdca79ce90137e978eabfb4ad00bea8bf75f74..f1b1160dbbb4f2fe0c7a27ba8706ab919aaf14bb 100644 (file)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -654,8 +654,6 @@ static void __mptcp_close(struct sock *sk, long timeout)
                __mptcp_close_ssk(sk, ssk, subflow, timeout);
        }
 
-       if (msk->cached_ext)
-               __skb_ext_put(msk->cached_ext);
        release_sock(sk);
        sk_common_release(sk);
 }
@@ -776,6 +774,10 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
 
 static void mptcp_destroy(struct sock *sk)
 {
+       struct mptcp_sock *msk = mptcp_sk(sk);
+
+       if (msk->cached_ext)
+               __skb_ext_put(msk->cached_ext);
 }
 
 static int mptcp_setsockopt(struct sock *sk, int level, int optname,