1 files changed, 19 insertions, 1 deletions

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index a03268454a27..85e4fe4f18cc 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -366,7 +366,6 @@ static int xsk_release(struct socket *sock)
 
         xskq_destroy(xs->rx);
         xskq_destroy(xs->tx);
-        xdp_put_umem(xs->umem);
 
         sock_orphan(sk);
         sock->sk = NULL;
@@ -669,6 +668,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
                 if (!umem)
                         return -EINVAL;
 
+                /* Matches the smp_wmb() in XDP_UMEM_REG */
+                smp_rmb();
                 if (offset == XDP_UMEM_PGOFF_FILL_RING)
                         q = READ_ONCE(umem->fq);
                 else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
@@ -678,6 +679,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
         if (!q)
                 return -EINVAL;
 
+        /* Matches the smp_wmb() in xsk_init_queue */
+        smp_rmb();
         qpg = virt_to_head_page(q->ring);
         if (size > (PAGE_SIZE << compound_order(qpg)))
                 return -EINVAL;
@@ -714,6 +717,18 @@ static const struct proto_ops xsk_proto_ops = {
         .sendpage       = sock_no_sendpage,
 };
 
+static void xsk_destruct(struct sock *sk)
+{
+        struct xdp_sock *xs = xdp_sk(sk);
+
+        if (!sock_flag(sk, SOCK_DEAD))
+                return;
+
+        xdp_put_umem(xs->umem);
+
+        sk_refcnt_debug_dec(sk);
+}
+
 static int xsk_create(struct net *net, struct socket *sock, int protocol,
                       int kern)
 {
@@ -740,6 +755,9 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
 
         sk->sk_family = PF_XDP;
 
+        sk->sk_destruct = xsk_destruct;
+        sk_refcnt_debug_inc(sk);
+
         sock_set_flag(sk, SOCK_RCU_FREE);
 
         xs = xdp_sk(sk);