The re-check of pm->accept_subflow with pm->lock held was missing, this
patch fixed it.

Suggested-by: Mat Martineau <mathew.j.martin...@linux.intel.com>
Reviewed-by: Mat Martineau <mathew.j.martin...@linux.intel.com>
Signed-off-by: Geliang Tang <geliangt...@gmail.com>
---
 net/mptcp/pm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index 39a76620d0a5..be4157279e15 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -48,7 +48,7 @@ void mptcp_pm_new_connection(struct mptcp_sock *msk, int 
server_side)
 bool mptcp_pm_allow_new_subflow(struct mptcp_sock *msk)
 {
        struct mptcp_pm_data *pm = &msk->pm;
-       int ret;
+       int ret = 0;
 
        pr_debug("msk=%p subflows=%d max=%d allow=%d", msk, pm->subflows,
                 pm->subflows_max, READ_ONCE(pm->accept_subflow));
@@ -58,9 +58,11 @@ bool mptcp_pm_allow_new_subflow(struct mptcp_sock *msk)
                return false;
 
        spin_lock_bh(&pm->lock);
-       ret = pm->subflows < pm->subflows_max;
-       if (ret && ++pm->subflows == pm->subflows_max)
-               WRITE_ONCE(pm->accept_subflow, false);
+       if (READ_ONCE(pm->accept_subflow)) {
+               ret = pm->subflows < pm->subflows_max;
+               if (ret && ++pm->subflows == pm->subflows_max)
+                       WRITE_ONCE(pm->accept_subflow, false);
+       }
        spin_unlock_bh(&pm->lock);
 
        return ret;
-- 
2.17.1

Reply via email to