Hello,
On Wed, 10 Sep 2025, Slavin Liu wrote:
> On netns cleanup path, before unregistration in __ip_vs_ftp_exit(),
> there could still be existing conns with valid cp->app.
>
> Suggested by Julian, this patch fixes this issue by checking ipvs->enable
> to ensure the right order of cleanup:
> 1. Set ipvs->enable to 0 in ipvs_core_dev_ops->exit_batch()
> 2. Skip app unregistration in ip_vs_ftp_ops->exit() by
> checking ipvs->enable
> 3. Flush all conns in ipvs_core_ops->exit_batch()
> 4. Unregister all apps in ipvs_core_ops->exit_batch()
>
> Access ipvs->enable by READ_ONCE to avoid concurrency issue.
>
> Suggested-by: Julian Anastasov <ja@xxxxxx>
> Signed-off-by: Slavin Liu <slavin452@xxxxxxxxx>
> ---
> net/netfilter/ipvs/ip_vs_ftp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
> index d8a284999544..d3e2f7798bf3 100644
> --- a/net/netfilter/ipvs/ip_vs_ftp.c
> +++ b/net/netfilter/ipvs/ip_vs_ftp.c
> @@ -605,7 +605,7 @@ static void __ip_vs_ftp_exit(struct net *net)
> {
> struct netns_ipvs *ipvs = net_ipvs(net);
>
> - if (!ipvs)
> + if (!ipvs || !READ_ONCE(ipvs->enable))
Ops, I forgot that ipvs->enable is set later when
service is added. May be we have to add some new global flag
for this in ip_vs_ftp.c:
static bool removing;
We will set it in ip_vs_ftp_exit() before calling
unregister_pernet_subsys() and the above check will become:
if (!ipvs || !removing)
Also, we have to add Fixes tag, this looks the
one that starts to remove apps from netns exit handler:
Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Regards
--
Julian Anastasov <ja@xxxxxx>
