Latest patch series ('inet-frags-avoid-possible-races-at-netns-dismantle') brought another syzbot report shown in the third patch changelog.
While fixing the issue, I had to call inet_frags_fini() later in IPv6 and ilowpan. Also I believe a completion is needed to ensure proper dismantle at module removal. Eric Dumazet (3): inet: frags: uninline fqdir_init() inet: frags: call inet_frags_fini() after unregister_pernet_subsys() inet: frags: fix use-after-free read in inet_frag_destroy_rcu include/net/inet_frag.h | 23 +++-------------- net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/inet_fragment.c | 39 +++++++++++++++++++++++++++-- net/ipv6/reassembly.c | 2 +- 4 files changed, 43 insertions(+), 23 deletions(-) -- 2.22.0.rc1.257.g3120a18244-goog