@@ -620,9 +620,8 @@ static bool move_skbs_to_msk(struct mptcp_sock *msk, struct sock *ssk)
620620 * this is not a good place to change state. Let the workqueue
621621 * do it.
622622 */
623- if (mptcp_pending_data_fin (sk , NULL ) &&
624- schedule_work (& msk -> work ))
625- sock_hold (sk );
623+ if (mptcp_pending_data_fin (sk , NULL ))
624+ mptcp_schedule_work (sk );
626625 }
627626
628627 spin_unlock_bh (& sk -> sk_lock .slock );
@@ -699,23 +698,32 @@ static void mptcp_reset_timer(struct sock *sk)
699698 sk_reset_timer (sk , & icsk -> icsk_retransmit_timer , jiffies + tout );
700699}
701700
701+ bool mptcp_schedule_work (struct sock * sk )
702+ {
703+ if (inet_sk_state_load (sk ) != TCP_CLOSE &&
704+ schedule_work (& mptcp_sk (sk )-> work )) {
705+ /* each subflow already holds a reference to the sk, and the
706+ * workqueue is invoked by a subflow, so sk can't go away here.
707+ */
708+ sock_hold (sk );
709+ return true;
710+ }
711+ return false;
712+ }
713+
702714void mptcp_data_acked (struct sock * sk )
703715{
704716 mptcp_reset_timer (sk );
705717
706718 if ((!test_bit (MPTCP_SEND_SPACE , & mptcp_sk (sk )-> flags ) ||
707- (inet_sk_state_load (sk ) != TCP_ESTABLISHED )) &&
708- schedule_work (& mptcp_sk (sk )-> work ))
709- sock_hold (sk );
719+ (inet_sk_state_load (sk ) != TCP_ESTABLISHED )))
720+ mptcp_schedule_work (sk );
710721}
711722
712723void mptcp_subflow_eof (struct sock * sk )
713724{
714- struct mptcp_sock * msk = mptcp_sk (sk );
715-
716- if (!test_and_set_bit (MPTCP_WORK_EOF , & msk -> flags ) &&
717- schedule_work (& msk -> work ))
718- sock_hold (sk );
725+ if (!test_and_set_bit (MPTCP_WORK_EOF , & mptcp_sk (sk )-> flags ))
726+ mptcp_schedule_work (sk );
719727}
720728
721729static void mptcp_check_for_eof (struct mptcp_sock * msk )
@@ -1620,8 +1628,7 @@ static void mptcp_retransmit_handler(struct sock *sk)
16201628 mptcp_stop_timer (sk );
16211629 } else {
16221630 set_bit (MPTCP_WORK_RTX , & msk -> flags );
1623- if (schedule_work (& msk -> work ))
1624- sock_hold (sk );
1631+ mptcp_schedule_work (sk );
16251632 }
16261633}
16271634
@@ -2334,7 +2341,8 @@ static void mptcp_release_cb(struct sock *sk)
23342341 struct sock * ssk ;
23352342
23362343 ssk = mptcp_subflow_recv_lookup (msk );
2337- if (!ssk || !schedule_work (& msk -> work ))
2344+ if (!ssk || sk -> sk_state == TCP_CLOSE ||
2345+ !schedule_work (& msk -> work ))
23382346 __sock_put (sk );
23392347 }
23402348
0 commit comments