Re: [PATCH net] tcp/dccp: block bh before arming time_wait timer

On Fri, 2017-12-01 at 15:12 -0500, David Miller wrote:

From: Eric Dumazet <redacted>
Date: Fri, 01 Dec 2017 10:06:56 -0800

quoted

From: Eric Dumazet <redacted>

Maciej Żenczykowski reported some panics in tcp_twsk_destructor()
that might be caused by the following bug.

timewait timer is pinned to the cpu, because we want to transition
timwewait refcount from 0 to 4 in one go, once everything has been
initialized.

At the time commit ed2e92394589 ("tcp/dccp: fix timewait races in

timer

quoted

handling") was merged, TCP was always running from BH habdler.

After commit 5413d1babe8f ("net: do not block BH while processing
socket backlog") we definitely can run tcp_time_wait() from process
context.

We need to block BH in the critical section so that the pinned

timer

quoted

has still its purpose.

This bug is more likely to happen under stress and when very small

RTO

quoted

are used in datacenter flows.

Fixes: 5413d1babe8f ("net: do not block BH while processing socket

backlog")

quoted

Signed-off-by: Eric Dumazet <redacted>
Reported-by: Maciej Żenczykowski <redacted>

Applied and queued up for -stable, thanks Eric.

It just occurred to me that we can now revert 614bdd4d6e61d26
("tcp: must block bh in __inet_twsk_hashdance()")