| Message ID | 152035113120.7345.6783907370059817929.stgit@localhost.localdomain |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net: Fix hlist corruptions in inet_evict_bucket() | expand |
From: Kirill Tkhai <ktkhai@virtuozzo.com> Date: Tue, 06 Mar 2018 18:46:39 +0300 > inet_evict_bucket() iterates global list, and > several tasks may call it in parallel. All of > them hash the same fq->list_evictor to different > lists, which leads to list corruption. > > This patch makes fq be hashed to expired list > only if this has not been made yet by another > task. Since inet_frag_alloc() allocates fq > using kmem_cache_zalloc(), we may rely on > list_evictor is initially unhashed. > > The problem seems to exist before async > pernet_operations, as there was possible to have > exit method to be executed in parallel with > inet_frags::frags_work, so I add two Fixes tags. > This also may go to stable. > > Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor" > Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()" > Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Applied and queued up for -stable, thank you.
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 26a3d0315728..e8ec28999f5c 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -119,6 +119,9 @@ static void inet_frag_secret_rebuild(struct inet_frags *f) static bool inet_fragq_should_evict(const struct inet_frag_queue *q) { + if (!hlist_unhashed(&q->list_evictor)) + return false; + return q->net->low_thresh == 0 || frag_mem_limit(q->net) >= q->net->low_thresh; }
inet_evict_bucket() iterates global list, and several tasks may call it in parallel. All of them hash the same fq->list_evictor to different lists, which leads to list corruption. This patch makes fq be hashed to expired list only if this has not been made yet by another task. Since inet_frag_alloc() allocates fq using kmem_cache_zalloc(), we may rely on list_evictor is initially unhashed. The problem seems to exist before async pernet_operations, as there was possible to have exit method to be executed in parallel with inet_frags::frags_work, so I add two Fixes tags. This also may go to stable. Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor" Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()" Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> --- net/ipv4/inet_fragment.c | 3 +++ 1 file changed, 3 insertions(+)