Commit 40fb7220 authored by Julian Anastasov's avatar Julian Anastasov Committed by Jakub Kicinski
Browse files

ipvs: do not keep dest_dst after dest is removed 



Before now dest->dest_dst is not released when server is moved into
dest_trash list after removal. As result, we can keep dst/dev
references for long time without actively using them.

It is better to avoid walking the dest_trash list when
ip_vs_dst_event() receives dev events. So, make sure we do not
hold dev references in dest_trash list. As packets can be flying
while server is being removed, check the IP_VS_DEST_F_AVAILABLE
flag in slow path to ensure we do not save new dev references to
removed servers.

Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20260224205048.4718-5-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b24ae1a3

net/netfilter/ipvs/ip_vs_ctl.c

+8 −12
Original line number Diff line number Diff line
@@ -809,7 +809,6 @@ static void ip_vs_dest_free(struct ip_vs_dest *dest) 
{

	struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);



	__ip_vs_dst_cache_reset(dest);

	__ip_vs_svc_put(svc);

	call_rcu(&dest->rcu_head, ip_vs_dest_rcu_free);

}
@@ -1012,10 +1011,6 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, 


	dest->af = udest->af;



	spin_lock_bh(&dest->dst_lock);

	__ip_vs_dst_cache_reset(dest);

	spin_unlock_bh(&dest->dst_lock);



	if (add) {

		list_add_rcu(&dest->n_list, &svc->destinations);

		svc->num_dests++;
@@ -1023,6 +1018,10 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, 
		if (sched && sched->add_dest)

			sched->add_dest(svc, dest);

	} else {

		spin_lock_bh(&dest->dst_lock);

		__ip_vs_dst_cache_reset(dest);

		spin_unlock_bh(&dest->dst_lock);



		sched = rcu_dereference_protected(svc->scheduler, 1);

		if (sched && sched->upd_dest)

			sched->upd_dest(svc, dest);
@@ -1257,6 +1256,10 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc, 
{

	dest->flags &= ~IP_VS_DEST_F_AVAILABLE;



	spin_lock_bh(&dest->dst_lock);

	__ip_vs_dst_cache_reset(dest);

	spin_unlock_bh(&dest->dst_lock);



	/*

	 *  Remove it from the d-linked destination list.

	 */
@@ -1747,13 +1750,6 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event, 
	}

	rcu_read_unlock();



	mutex_lock(&ipvs->service_mutex);

	spin_lock_bh(&ipvs->dest_trash_lock);

	list_for_each_entry(dest, &ipvs->dest_trash, t_list) {

		ip_vs_forget_dev(dest, dev);

	}

	spin_unlock_bh(&ipvs->dest_trash_lock);

	mutex_unlock(&ipvs->service_mutex);

	return NOTIFY_DONE;

}

net/netfilter/ipvs/ip_vs_xmit.c

+8 −4
Original line number Diff line number Diff line
@@ -336,9 +336,11 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, 
				goto err_unreach;

			}

			/* It is forbidden to attach dest->dest_dst if

			 * device is going down.

			 * device is going down or if server is removed and

			 * stored in dest_trash.

			 */

			if (!rt_dev_is_down(dst_dev_rcu(&rt->dst)))

			if (!rt_dev_is_down(dst_dev_rcu(&rt->dst)) &&

			    dest->flags & IP_VS_DEST_F_AVAILABLE)

				__ip_vs_dst_set(dest, dest_dst, &rt->dst, 0);

			else

				noref = 0;
@@ -513,9 +515,11 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb, 
			rt = dst_rt6_info(dst);

			cookie = rt6_get_cookie(rt);

			/* It is forbidden to attach dest->dest_dst if

			 * device is going down.

			 * device is going down or if server is removed and

			 * stored in dest_trash.

			 */

			if (!rt_dev_is_down(dst_dev_rcu(&rt->dst)))

			if (!rt_dev_is_down(dst_dev_rcu(&rt->dst)) &&

			    dest->flags & IP_VS_DEST_F_AVAILABLE)

				__ip_vs_dst_set(dest, dest_dst, &rt->dst, cookie);

			else

				noref = 0;