net: Fix hlist corruptions in inet_evict_bucket()
authorKirill Tkhai <ktkhai@virtuozzo.com>
Tue, 6 Mar 2018 15:46:39 +0000 (18:46 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 31 Mar 2018 16:10:40 +0000 (18:10 +0200)
commit946b9671ac02842c454f4da7b560feb9c84a4356
tree360ad3787fb0e781fbe536db3afba7092afcf2d4
parent4ff5078b0396960c69718a41f916f81a6c59b074
net: Fix hlist corruptions in inet_evict_bucket()

[ Upstream commit a560002437d3646dafccecb1bf32d1685112ddda ]

inet_evict_bucket() iterates global list, and
several tasks may call it in parallel. All of
them hash the same fq->list_evictor to different
lists, which leads to list corruption.

This patch makes fq be hashed to expired list
only if this has not been made yet by another
task. Since inet_frag_alloc() allocates fq
using kmem_cache_zalloc(), we may rely on
list_evictor is initially unhashed.

The problem seems to exist before async
pernet_operations, as there was possible to have
exit method to be executed in parallel with
inet_frags::frags_work, so I add two Fixes tags.
This also may go to stable.

Fixes: d1fe19444d82 "inet: frag: don't re-use chainlist for evictor"
Fixes: f84c6821aa54 "net: Convert pernet_subsys, registered from inet_init()"
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/inet_fragment.c