• Kirill Tkhai's avatar
    net: Fix hlist corruptions in inet_evict_bucket() · 51b4111f
    Kirill Tkhai authored
    
    [ Upstream commit a5600024 ]
    
    inet_evict_bucket() iterates global list, and
    several tasks may call it in parallel. All of
    them hash the same fq->list_evictor to different
    lists, which leads to list corruption.
    
    This patch makes fq be hashed to expired list
    only if this has not been made yet by another
    task. Since inet_frag_alloc() allocates fq
    using kmem_cache_zalloc(), we may rely on
    list_evictor is initially unhashed.
    
    The problem seems to exist before async
    pernet_operations, as there was possible to have
    exit method to be executed in parallel with
    inet_frags::frags_work, so I add two Fixes tags.
    This also may go to stable.
    
    Fixes: d1fe1944 "inet: frag: don't re-use chainlist for evictor"
    Fixes: f84c6821 "net: Convert pernet_subsys, registered from inet_init()"
    Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    51b4111f
inet_fragment.c 10.5 KB