From: Eric Dumazet <eric.duma...@gmail.com>
Date: Fri, 01 Dec 2017 10:06:56 -0800
> From: Eric Dumazet <eduma...@google.com>
>
> Maciej Żenczykowski reported some panics in tcp_twsk_destructor()
> that might be caused by the following bug.
>
> timewait timer is pinned to the cpu, because we want to transition
> timwewait refcount from 0 to 4 in one go, once everything has been
> initialized.
>
> At the time commit ed2e92394589 ("tcp/dccp: fix timewait races in timer
> handling") was merged, TCP was always running from BH habdler.
>
> After commit 5413d1babe8f ("net: do not block BH while processing
> socket backlog") we definitely can run tcp_time_wait() from process
> context.
>
> We need to block BH in the critical section so that the pinned timer
> has still its purpose.
>
> This bug is more likely to happen under stress and when very small RTO
> are used in datacenter flows.
>
> Fixes: 5413d1babe8f ("net: do not block BH while processing socket backlog")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: Maciej Żenczykowski <m...@google.com>
Applied and queued up for -stable, thanks Eric.
