Eric Dumazet ed2e923945 tcp/dccp: fix timewait races in timer handling
When creating a timewait socket, we need to arm the timer before
allowing other cpus to find it. The signal allowing cpus to find
the socket is setting tw_refcnt to non zero value.

As we set tw_refcnt in __inet_twsk_hashdance(), we therefore need to
call inet_twsk_schedule() first.

This also means we need to remove tw_refcnt changes from
inet_twsk_schedule() and let the caller handle it.

Note that because we use mod_timer_pinned(), we have the guarantee
the timer wont expire before we set tw_refcnt as we run in BH context.

To make things more readable I introduced inet_twsk_reschedule() helper.

When rearming the timer, we can use mod_timer_pending() to make sure
we do not rearm a canceled timer.

Note: This bug can possibly trigger if packets of a flow can hit
multiple cpus. This does not normally happen, unless flow steering
is broken somehow. This explains this bug was spotted ~5 months after
its introduction.

A similar fix is needed for SYN_RECV sockets in reqsk_queue_hash_req(),
but will be provided in a separate patch for proper tracking.

Fixes: 789f558cfb36 ("tcp/dccp: get rid of central timewait timer")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Ying Cai <ycai@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-09-21 16:32:29 -07:00
..
2015-06-14 12:55:49 -07:00
2015-09-09 08:33:31 -07:00
2014-09-18 10:54:36 +02:00
2015-03-04 00:23:23 -05:00
2015-06-28 16:55:44 -07:00
2015-03-06 21:50:02 -05:00
2015-08-18 14:17:21 -07:00
2015-08-31 21:23:42 -07:00
2013-11-07 19:28:58 -05:00
2014-09-30 01:02:26 -04:00
2015-03-12 14:39:40 -04:00
2014-01-03 20:56:48 -05:00
2015-07-21 10:39:05 -07:00
2014-06-02 11:00:41 -07:00
2015-03-12 22:58:12 -04:00
2014-05-22 14:57:15 -04:00
2015-09-01 14:32:44 -07:00
2015-08-11 12:41:35 +02:00