On Mon, May 27, 2019 at 11:34 PM Herbert Xu wrote:
>
> Hi Eric:
>
> Eric Dumazet wrote:
> >
> > +void fqdir_exit(struct fqdir *fqdir)
> > +{
> > + fqdir->high_thresh = 0; /* prevent creation of new frags */
> > +
> > + /* paired with READ_ONCE() in inet_frag_kill() :
> > +* We
Hi Eric:
Eric Dumazet wrote:
>
> +void fqdir_exit(struct fqdir *fqdir)
> +{
> + fqdir->high_thresh = 0; /* prevent creation of new frags */
> +
> + /* paired with READ_ONCE() in inet_frag_kill() :
> +* We want to prevent rhashtable_remove_fast() calls
> +*/
> + s
syszbot found an interesting use-after-free [1] happening
while IPv4 fragment rhashtable was destroyed at netns dismantle.
While no insertions can possibly happen at the time a dismantling
netns is destroying this rhashtable, timers can still fire and
attempt to remove elements from this rhashtabl
