synchronization between net_bh and user-context

[Ronghua Zhang]

I am reading the TCP/IP code of kernel 2.2.15 and doing some development
based on it(yes, I know it's an old version, but I have to). I got a
little confused about the synchronization between net_bh and user-context,
and hope someone can help me out.

Specifically, why the following is impossible?
destroy_sock is called on CPU1, and a little bit later net_bh() is
executed on CPU2, which will grab the pointer to the socket just before
it's destroyed, and its later access becomes invalid.

CPU 1                                 CPU2
destroy_sock()
 lock_sock()
   sk->sock_readers++
   synchronize_bh(), no bh is running

                                    now net_bh() get called
                                    =>tcp_v4_rcv()
                                       sk = __tcp_v4_lookup(...)
                                        sk has not been destroyed

 tcp_v4_destroy_sock()
 kill_sk_now() free sk
                                         now sk has been destroyed
                                       if (!atomic_read(&sk->sock_readers))
                                            <-- sk become invalid

ronghua