I am reading the TCP/IP code of kernel 2.2.15 and doing some development
based on it(yes, I know it's an old version, but I have to). I got a
little confused about the synchronization between net_bh and user-context,
and hope someone can help me out.
Specifically, why the following is impossible?
destroy_sock is called on CPU1, and a little bit later net_bh() is
executed on CPU2, which will grab the pointer to the socket just before
it's destroyed, and its later access becomes invalid.
CPU 1 CPU2
synchronize_bh(), no bh is running
now net_bh() get called
sk = __tcp_v4_lookup(...)
sk has not been destroyed
kill_sk_now() free sk
now sk has been destroyed
<-- sk become invalid