From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([184.105.139.130]:55368 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751220AbeCGS34 (ORCPT
        <rfc822;netdev@vger.kernel.org>); Wed, 7 Mar 2018 13:29:56 -0500
Date: Wed, 07 Mar 2018 13:29:54 -0500 (EST)
Message-Id: <20180307.132954.1909588060680439166.davem@davemloft.net>
To: ktkhai@virtuozzo.com
Cc: fw@strlen.de, yoshfuji@linux-ipv6.org, netdev@vger.kernel.org
Subject: Re: [PATCH net] net: Fix hlist corruptions in inet_evict_bucket()
From: David Miller <davem@davemloft.net>
In-Reply-To: <152035113120.7345.6783907370059817929.stgit@localhost.localdomain>
References: <152035113120.7345.6783907370059817929.stgit@localhost.localdomain>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Kirill Tkhai <ktkhai@virtuozzo.com>
Date: Tue, 06 Mar 2018 18:46:39 +0300

> inet_evict_bucket() iterates global list, and
> several tasks may call it in parallel. All of
> them hash the same fq->list_evictor to different
> lists, which leads to list corruption.
> 
> This patch makes fq be hashed to expired list
> only if this has not been made yet by another
> task. Since inet_frag_alloc() allocates fq
> using kmem_cache_zalloc(), we may rely on
> list_evictor is initially unhashed.
> 
> The problem seems to exist before async
> pernet_operations, as there was possible to have
> exit method to be executed in parallel with
> inet_frags::frags_work, so I add two Fixes tags.
> This also may go to stable.
> 
> Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor"
> Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()"
> Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>

Applied and queued up for -stable, thank you.