2 files changed, 25 insertions, 7 deletions

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index ccee7244ca0f..1d9790e43dfc 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -97,24 +97,40 @@ static struct sock *__udp6_lib_lookup(struct net *net,
                                       struct in6_addr *daddr, __be16 dport,
                                       int dif, struct udp_table *udptable)
 {
-        struct sock *sk, *result = NULL;
+        struct sock *sk, *result;
         struct hlist_node *node;
         unsigned short hnum = ntohs(dport);
         unsigned int hash = udp_hashfn(net, hnum);
         struct udp_hslot *hslot = &udptable->hash[hash];
-        int score, badness = -1;
+        int score, badness;
 
-        spin_lock(&hslot->lock);
-        sk_for_each(sk, node, &hslot->head) {
+        rcu_read_lock();
+begin:
+        result = NULL;
+        badness = -1;
+        sk_for_each_rcu(sk, node, &hslot->head) {
+                /*
+                 * lockless reader, and SLAB_DESTROY_BY_RCU items:
+                 * We must check this item was not moved to another chain
+                 */
+                if (udp_hashfn(net, sk->sk_hash) != hash)
+                        goto begin;
                 score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
                 if (score > badness) {
                         result = sk;
                         badness = score;
                 }
         }
-        if (result)
-                sock_hold(result);
-        spin_unlock(&hslot->lock);
+        if (result) {
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score(result, net, hnum, saddr, sport,
+                                        daddr, dport, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        rcu_read_unlock();
         return result;
 }
 
@@ -1062,6 +1078,7 @@ struct proto udpv6_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp6_sock),
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index f1e892a99e05..ba162a824585 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -49,6 +49,7 @@ struct proto udplitev6_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,