Commit e92b8475 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman

inet: frags: better deal with smp races

commit 0d5b9311baf27bb545f187f12ecfd558220c607d upstream.

Multiple cpus might attempt to insert a new fragment in rhashtable,
if for example RPS is buggy, as reported by 배석진 in

We use rhashtable_lookup_get_insert_key() instead of
rhashtable_insert_fast() to let cpus losing the race
free their own inet_frag_queue and use the one that
was inserted by another cpu.

Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: default avatarEric Dumazet <>
Reported-by: default avatar배석진 <>
Signed-off-by: default avatarDavid S. Miller <>
Signed-off-by: default avatarBen Hutchings <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent acd00a06
......@@ -188,21 +188,22 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
void *arg)
void *arg,
struct inet_frag_queue **prev)
struct inet_frags *f = nf->f;
struct inet_frag_queue *q;
int err;
q = inet_frag_alloc(nf, f, arg);
if (!q)
if (!q) {
*prev = ERR_PTR(-ENOMEM);
return NULL;
mod_timer(&q->timer, jiffies + nf->timeout);
err = rhashtable_insert_fast(&nf->rhashtable, &q->node,
if (err < 0) {
*prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key,
&q->node, f->rhash_params);
if (*prev) {
......@@ -215,17 +216,18 @@ EXPORT_SYMBOL(inet_frag_create);
/* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
struct inet_frag_queue *fq;
struct inet_frag_queue *fq = NULL, *prev;
fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
if (fq) {
prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
if (!prev)
fq = inet_frag_create(nf, key, &prev);
if (prev && !IS_ERR(prev)) {
fq = prev;
if (!atomic_inc_not_zero(&fq->refcnt))
fq = NULL;
return fq;
return inet_frag_create(nf, key);
return fq;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment