2 files changed, 6 insertions, 4 deletions

diff --git a/include/linux/net.h b/include/linux/net.h
index 16faa130088c..94de83c0f877 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -118,6 +118,7 @@ enum sock_shutdown_cmd {
 };
 
 struct socket_wq {
+        /* Note: wait MUST be first field of socket_wq */
         wait_queue_head_t       wait;
         struct fasync_struct    *fasync_list;
         struct rcu_head         rcu;
@@ -142,7 +143,7 @@ struct socket {
 
         unsigned long           flags;
 
-        struct socket_wq        *wq;
+        struct socket_wq __rcu  *wq;
 
         struct file             *file;
         struct sock             *sk;
diff --git a/include/net/sock.h b/include/net/sock.h
index e3893a2b5d25..da0534d3401c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -281,7 +281,7 @@ struct sock {
         int                     sk_rcvbuf;
 
         struct sk_filter __rcu  *sk_filter;
-        struct socket_wq        *sk_wq;
+        struct socket_wq __rcu  *sk_wq;
 
 #ifdef CONFIG_NET_DMA
         struct sk_buff_head     sk_async_wait_queue;
@@ -1266,7 +1266,8 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
 
 static inline wait_queue_head_t *sk_sleep(struct sock *sk)
 {
-        return &sk->sk_wq->wait;
+        BUILD_BUG_ON(offsetof(struct socket_wq, wait) != 0);
+        return &rcu_dereference_raw(sk->sk_wq)->wait;
 }
 /* Detach socket from process context.
  * Announce socket dead, detach it from wait queue and inode.
@@ -1287,7 +1288,7 @@ static inline void sock_orphan(struct sock *sk)
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
         write_lock_bh(&sk->sk_callback_lock);
-        rcu_assign_pointer(sk->sk_wq, parent->wq);
+        sk->sk_wq = parent->wq;
         parent->sk = sk;
         sk_set_socket(sk, parent);
         security_sock_graft(sk, parent);