Patch "net: Fix hlist corruptions in inet_evict_bucket()" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

net: Fix hlist corruptions in inet_evict_bucket()

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-fix-hlist-corruptions-in-inet_evict_bucket.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Kirill Tkhai <[email protected]>
Date: Tue, 6 Mar 2018 18:46:39 +0300
Subject: net: Fix hlist corruptions in inet_evict_bucket()

From: Kirill Tkhai <[email protected]>

[ Upstream commit a560002437d3646dafccecb1bf32d1685112ddda ]

inet_evict_bucket() iterates global list, and
several tasks may call it in parallel. All of
them hash the same fq->list_evictor to different
lists, which leads to list corruption.

This patch makes fq be hashed to expired list
only if this has not been made yet by another
task. Since inet_frag_alloc() allocates fq
using kmem_cache_zalloc(), we may rely on
list_evictor is initially unhashed.

The problem seems to exist before async
pernet_operations, as there was possible to have
exit method to be executed in parallel with
inet_frags::frags_work, so I add two Fixes tags.
This also may go to stable.

---
 net/ipv4/inet_fragment.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -119,6 +119,9 @@ out:
 
 static bool inet_fragq_should_evict(const struct inet_frag_queue *q)
 {
+	if (!hlist_unhashed(&q->list_evictor))
+		return false;
+
 	return q->net->low_thresh == 0 ||
 	       frag_mem_limit(q->net) >= q->net->low_thresh;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/net-fix-hlist-corruptions-in-inet_evict_bucket.patch