]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
tcp/dccp: block bh before arming time_wait timer
authorEric Dumazet <edumazet@google.com>
Fri, 1 Dec 2017 18:06:56 +0000 (10:06 -0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 1 Dec 2017 20:07:43 +0000 (15:07 -0500)
commitcfac7f836a715b91f08c851df915d401a4d52783
tree129ca3745010edb380f18e9420ea50ede3b8b1bc
parentb484d8a53e31f3773ca5f24c00fc25ef97ace03d
tcp/dccp: block bh before arming time_wait timer

Maciej Żenczykowski reported some panics in tcp_twsk_destructor()
that might be caused by the following bug.

timewait timer is pinned to the cpu, because we want to transition
timwewait refcount from 0 to 4 in one go, once everything has been
initialized.

At the time commit ed2e92394589 ("tcp/dccp: fix timewait races in timer
handling") was merged, TCP was always running from BH habdler.

After commit 5413d1babe8f ("net: do not block BH while processing
socket backlog") we definitely can run tcp_time_wait() from process
context.

We need to block BH in the critical section so that the pinned timer
has still its purpose.

This bug is more likely to happen under stress and when very small RTO
are used in datacenter flows.

Fixes: 5413d1babe8f ("net: do not block BH while processing socket backlog")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Maciej Żenczykowski <maze@google.com>
Acked-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/dccp/minisocks.c
net/ipv4/tcp_minisocks.c