Subject: Re: [PATCH net-next 2/2] 6lowpan: reassembly: fix kernel oops while unloading

From: Florian Westphal <[email-masked]>
Date: Wed, 5 Mar 2014 23:32:46 +0100

Alexander Aring <[email-masked]> wrote:
> It seems that the inet_frag_queue is deleted but the timer is running. This
> patch adds a for loop to iterate over all frag_queue entries in the
> frag_bucket and calling del_timer for each frag_queue entry while
> unloading the 6lowpan module.
> 
> Signed-off-by: Alexander Aring <[email-masked]>
> Reported-by: Phoebe Buckheister <[email-masked]>
> ---
> I am not sure about that I can do that in this simply way without hold
> any lock of the inet_frag_queue or inet_frag_bucket. Please help there.
> The kernel oops never occurs afterwards, but this isn't simple to test.
> I can't test all cases.

I find it hard to believe that this is a 6lowpan specific problem,
most likely this needs a fix in inet_fragment code.

I am currently looking at that code for different reasons anyway and can
investigate tomorrow if you do not have time for it.