1 files changed, 16 insertions, 8 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index bec01a3daf5b..2986941164b1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1769,7 +1769,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 
 out:
         if (err && rollover) {
-                kfree(rollover);
+                kfree_rcu(rollover, rcu);
                 po->rollover = NULL;
         }
         mutex_unlock(&fanout_mutex);
@@ -1796,8 +1796,10 @@ static struct packet_fanout *fanout_release(struct sock *sk)
                 else
                         f = NULL;
 
-                if (po->rollover)
+                if (po->rollover) {
                         kfree_rcu(po->rollover, rcu);
+                        po->rollover = NULL;
+                }
         }
         mutex_unlock(&fanout_mutex);
 
@@ -3851,6 +3853,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
         void *data = &val;
         union tpacket_stats_u st;
         struct tpacket_rollover_stats rstats;
+        struct packet_rollover *rollover;
 
         if (level != SOL_PACKET)
                 return -ENOPROTOOPT;
@@ -3929,13 +3932,18 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                        0);
                 break;
         case PACKET_ROLLOVER_STATS:
-                if (!po->rollover)
+                rcu_read_lock();
+                rollover = rcu_dereference(po->rollover);
+                if (rollover) {
+                        rstats.tp_all = atomic_long_read(&rollover->num);
+                        rstats.tp_huge = atomic_long_read(&rollover->num_huge);
+                        rstats.tp_failed = atomic_long_read(&rollover->num_failed);
+                        data = &rstats;
+                        lv = sizeof(rstats);
+                }
+                rcu_read_unlock();
+                if (!rollover)
                         return -EINVAL;
-                rstats.tp_all = atomic_long_read(&po->rollover->num);
-                rstats.tp_huge = atomic_long_read(&po->rollover->num_huge);
-                rstats.tp_failed = atomic_long_read(&po->rollover->num_failed);
-                data = &rstats;
-                lv = sizeof(rstats);
                 break;
         case PACKET_TX_HAS_OFF:
                 val = po->tp_tx_has_off;