Re: [PATCH net] inet: frag: make sure forced eviction removes all frags

[David Miller <davem@davemloft.net>]

From: Florian Westphal <fw@strlen.de>
Date: Thu,  6 Mar 2014 18:06:41 +0100

> Quoting Alexander Aring:
>   While fragmentation and unloading of 6lowpan module I got this kernel Oops
>   after few seconds:
> 
>   BUG: unable to handle kernel paging request at f88bbc30
>   [..]
>   Modules linked in: ipv6 [last unloaded: 6lowpan]
>   Call Trace:
>    [<c012af4c>] ? call_timer_fn+0x54/0xb3
>    [<c012aef8>] ? process_timeout+0xa/0xa
>    [<c012b66b>] run_timer_softirq+0x140/0x15f
> 
> Problem is that incomplete frags are still around after unload; when
> their frag expire timer fires, we get crash.
> 
> When a netns is removed (also done when unloading module), inet_frag
> calls the evictor with 'force' argument to purge remaining frags.
> 
> The evictor loop terminates when accounted memory ('work') drops to 0
> or the lru-list becomes empty.  However, the mem accounting is done
> via percpu counters and may not be accurate, i.e. loop may terminate
> prematurely.
> 
> Alter evictor to only stop once the lru list is empty when force is
> requested.
> 
> Reported-by: Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
> Reported-by: Alexander Aring <alex.aring@gmail.com>
> Tested-by: Alexander Aring <alex.aring@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>

Applied and queued up for -stable, thanks.