4 files changed, 23 insertions, 6 deletions

diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index e649bd3f2c97..3ba2998b22ba 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -383,5 +383,22 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
                 ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; }); \
                 pos = rcu_dereference(pos->next))
 
+/**
+ * hlist_for_each_entry_rcu_safenext - iterate over rcu list of given type
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @head:       the head for your list.
+ * @member:     the name of the hlist_node within the struct.
+ * @next:       the &struct hlist_node to use as a next cursor
+ *
+ * Special version of hlist_for_each_entry_rcu that make sure
+ * each next pointer is fetched before each iteration.
+ */
+#define hlist_for_each_entry_rcu_safenext(tpos, pos, head, member, next) \
+        for (pos = rcu_dereference((head)->first);                       \
+                pos && ({ next = pos->next; smp_rmb(); prefetch(next); 1; }) && \
+                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; }); \
+                pos = rcu_dereference(next))
+
 #endif  /* __KERNEL__ */
 #endif
diff --git a/include/net/sock.h b/include/net/sock.h
index 0bea25db5471..a4f6d3fc0470 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -419,8 +419,8 @@ static __inline__ void sk_add_bind_node(struct sock *sk,
 
 #define sk_for_each(__sk, node, list) \
         hlist_for_each_entry(__sk, node, list, sk_node)
-#define sk_for_each_rcu(__sk, node, list) \
-        hlist_for_each_entry_rcu(__sk, node, list, sk_node)
+#define sk_for_each_rcu_safenext(__sk, node, list, next) \
+        hlist_for_each_entry_rcu_safenext(__sk, node, list, sk_node, next)
 #define sk_for_each_from(__sk, node) \
         if (__sk && ({ node = &(__sk)->sk_node; 1; })) \
                 hlist_for_each_entry_from(__sk, node, sk_node)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ced820318f94..c3ecec8a9e1c 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -256,7 +256,7 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
                 int dif, struct udp_table *udptable)
 {
         struct sock *sk, *result;
-        struct hlist_node *node;
+        struct hlist_node *node, *next;
         unsigned short hnum = ntohs(dport);
         unsigned int hash = udp_hashfn(net, hnum);
         struct udp_hslot *hslot = &udptable->hash[hash];
@@ -266,7 +266,7 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
 begin:
         result = NULL;
         badness = -1;
-        sk_for_each_rcu(sk, node, &hslot->head) {
+        sk_for_each_rcu_safenext(sk, node, &hslot->head, next) {
                 /*
                  * lockless reader, and SLAB_DESTROY_BY_RCU items:
                  * We must check this item was not moved to another chain
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1d9790e43dfc..32d914db6c4f 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -98,7 +98,7 @@ static struct sock *__udp6_lib_lookup(struct net *net,
                                       int dif, struct udp_table *udptable)
 {
         struct sock *sk, *result;
-        struct hlist_node *node;
+        struct hlist_node *node, *next;
         unsigned short hnum = ntohs(dport);
         unsigned int hash = udp_hashfn(net, hnum);
         struct udp_hslot *hslot = &udptable->hash[hash];
@@ -108,7 +108,7 @@ static struct sock *__udp6_lib_lookup(struct net *net,
 begin:
         result = NULL;
         badness = -1;
-        sk_for_each_rcu(sk, node, &hslot->head) {
+        sk_for_each_rcu_safenext(sk, node, &hslot->head, next) {
                 /*
                  * lockless reader, and SLAB_DESTROY_BY_RCU items:
                  * We must check this item was not moved to another chain