Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2225262/?format=api
{ "id": 2225262, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2225262/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260420171308.87192-1-ja@ssi.bg/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260420171308.87192-1-ja@ssi.bg>", "date": "2026-04-20T17:13:08", "name": "[net] ipvs: fix races around est_mutex and est_cpulist", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "2d0ce485cb0aa6db7884ff0110229073aa37e264", "submitter": { "id": 2825, "url": "http://patchwork.ozlabs.org/api/1.1/people/2825/?format=api", "name": "Julian Anastasov", "email": "ja@ssi.bg" }, "delegate": { "id": 11902, "url": "http://patchwork.ozlabs.org/api/1.1/users/11902/?format=api", "username": "strlen", "first_name": "Florian", "last_name": "Westphal", "email": "fw@strlen.de" }, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260420171308.87192-1-ja@ssi.bg/mbox/", "series": [ { "id": 500661, "url": "http://patchwork.ozlabs.org/api/1.1/series/500661/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500661", "date": "2026-04-20T17:13:08", "name": "[net] ipvs: fix races around est_mutex and est_cpulist", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500661/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2225262/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2225262/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-12073-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=ssi.bg header.i=@ssi.bg header.a=rsa-sha256\n header.s=ssi header.b=o+WpO+tF;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12073-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=\"o+WpO+tF\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=193.238.174.39", "smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=ssi.bg" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fzvL26Dnsz1yCv\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 21 Apr 2026 04:35:06 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 174EE3199B56\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 20 Apr 2026 17:13:56 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 82AE337FF77;\n\tMon, 20 Apr 2026 17:13:55 +0000 (UTC)", "from mx.ssi.bg (mx.ssi.bg [193.238.174.39])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DEC63803F3;\n\tMon, 20 Apr 2026 17:13:51 +0000 (UTC)", "from mx.ssi.bg (localhost [127.0.0.1])\n\tby mx.ssi.bg (Potsfix) with ESMTP id 050B0210D3;\n\tMon, 20 Apr 2026 20:13:50 +0300 (EEST)", "from box.ssi.bg (box.ssi.bg [193.238.174.46])\n\tby mx.ssi.bg (Potsfix) with ESMTPS;\n\tMon, 20 Apr 2026 20:13:47 +0300 (EEST)", "from ja.ssi.bg (unknown [213.16.62.126])\n\tby box.ssi.bg (Potsfix) with ESMTPSA id E49AF628C8;\n\tMon, 20 Apr 2026 20:13:46 +0300 (EEST)", "from ja.home.ssi.bg (localhost.localdomain [127.0.0.1])\n\tby ja.ssi.bg (8.18.1/8.18.1) with ESMTP id 63KHDj2B087216;\n\tMon, 20 Apr 2026 20:13:45 +0300", "(from root@localhost)\n\tby ja.home.ssi.bg (8.18.1/8.18.1/Submit) id 63KHDjr8087215;\n\tMon, 20 Apr 2026 20:13:45 +0300" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776705234; cv=none;\n b=BgIcCyck6VhvV6RpwqP8rdmTCYeYXi251WEeOtTTFF0bjs+BJJ9/5qlX/C/Mw22d3opCKQMD+f1u9zBV2JnjHo23xJaGj+AWu1CU5K8G3kUQfAtyZhkO6ewN42sY3FCX4mkZfWAh6ckRJdeWJEOUAQe2BZMA2jHzvbJDwCvUa18=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776705234; c=relaxed/simple;\n\tbh=vbBalwyLlxwHVPo+rRYd+pCZFRGpWMku+UKNxgElFXs=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=SdtgHtgd3IyL/sRqZ+V8frlv1+2lBeUMNJ9P8MDTyOMqCcFvqoRYEQnf0B5F6MQmKEptxwakdIbkbvsViVf6NFkjohZKMLmHvzGE0KJA6IIrvcmQ8pbWbV2UrZLU4M0e3ilaB1WO/6fBrKgwxQjs7zrvElJDDcNiNFqEWhvqcZM=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg;\n spf=pass smtp.mailfrom=ssi.bg;\n dkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=o+WpO+tF;\n arc=none smtp.client-ip=193.238.174.39", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ssi.bg; h=cc:cc\n\t:content-transfer-encoding:date:from:from:message-id\n\t:mime-version:reply-to:subject:subject:to:to; s=ssi; bh=DZixscu+\n\to4afjZu0PixtPTvDZyQSbehndGDrvyrAB2k=; b=o+WpO+tFD8/YPVrXXRTHDTYK\n\t/Yy/i9GgWPWenmfJ9yDCpiRMLxNZBgCHju8Ebx1mD7SXdEOcwq1M4wOyk9VRUwNd\n\tQa6QnH1Z+QRnEO6orYk77S6PCEEQrRupNpXWDdQ1F0iJdL5H2rzQITf/KCor4jxk\n\t3vS//irKZwfDOFTFNRJ5LWvjP8GHTUwOv/9+T+WQ0V4Tq0bMQYf7F+Ooqyg5F2kc\n\tnaHWNKXzLeFUkvVkpmumjgG35r4bQJmXFTC6Pg3+INKGQ+3xuTPNbsBsL/00cCCy\n\tDyWBnRO1aLM6fhW3chAbIZUy6oZtrk1I3362CniKu0RmbEtZkuFPK76BtiCVhqhn\n\tkyIkXF0ysjzPaQMjINqArgjN6vKU1qgnDUEpPjADQzPQZMWHAN6L1DqcgGiPJb5p\n\t+upoEclFtTZaYnCMiI93g2/d/szQv6KJDjvl5DvEXNKp5gByR6ls60AryBEsNvwe\n\tVxPQzvJGk53FXjsUNeGZVebvRkJR9N4fyrv9ewpgBUQc9bkiPv+q9Ba1WrgC7BvM\n\td/j4bSd4rgvvz57joCGT0fWLUF3+D84WPrB/V8gHoVavL7tGdGiCduz2mgNcvHy4\n\twqUbvGMF7fWUthlNyyfjB3APaCd1hI/uQdPlCBamne345zSbce+gu/5Pia0VWC7o\n\ti31xt6GPeLinCby6+VA=", "From": "Julian Anastasov <ja@ssi.bg>", "To": "Simon Horman <horms@verge.net.au>", "Cc": "Pablo Neira Ayuso <pablo@netfilter.org>, Florian Westphal <fw@strlen.de>,\n lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org", "Subject": "[PATCH net] ipvs: fix races around est_mutex and est_cpulist", "Date": "Mon, 20 Apr 2026 20:13:08 +0300", "Message-ID": "<20260420171308.87192-1-ja@ssi.bg>", "X-Mailer": "git-send-email 2.53.0", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Sashiko reports for races and possible crash around\nthe usage of est_cpulist_valid and sysctl_est_cpulist.\nThe problem is that we do not lock est_mutex in some\nplaces which can lead to wrong write ordering and\nas result problems when calling cpumask_weight()\nand cpumask_empty().\n\nFix them by moving the est_max_threads read/write under\nlocked est_mutex. Do the same for one ip_vs_est_reload_start()\ncall to protect the cpumask_empty() usage of sysctl_est_cpulist.\n\nLink: https://sashiko.dev/#/patchset/20260331165015.2777765-1-longman%40redhat.com\nFixes: f0be83d54217 (\"ipvs: add est_cpulist and est_nice sysctl vars\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\n---\n\n Note that this patch complements v2 of patchset from 31-MAR-26\n \"ipvs: Fix incorrect use of HK_TYPE_KTHREAD housekeeping cpumask\"\n and can be applied before it to avoid the bad AI reviews:\n\n https://lore.kernel.org/all/20260331165015.2777765-1-longman@redhat.com/\n\n net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++\n net/netfilter/ipvs/ip_vs_est.c | 22 +++++++++++++++-------\n 2 files changed, 20 insertions(+), 7 deletions(-)", "diff": "diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c\nindex caec516856e9..8778e174ef56 100644\n--- a/net/netfilter/ipvs/ip_vs_ctl.c\n+++ b/net/netfilter/ipvs/ip_vs_ctl.c\n@@ -1812,11 +1812,16 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,\n \t*svc_p = svc;\n \n \tif (!READ_ONCE(ipvs->enable)) {\n+\t\tmutex_lock(&ipvs->est_mutex);\n+\n \t\t/* Now there is a service - full throttle */\n \t\tWRITE_ONCE(ipvs->enable, 1);\n \n+\t\tipvs->est_max_threads = ip_vs_est_max_threads(ipvs);\n+\n \t\t/* Start estimation for first time */\n \t\tip_vs_est_reload_start(ipvs);\n+\t\tmutex_unlock(&ipvs->est_mutex);\n \t}\n \n \treturn 0;\ndiff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c\nindex 433ba3cab58c..6c9981d5611e 100644\n--- a/net/netfilter/ipvs/ip_vs_est.c\n+++ b/net/netfilter/ipvs/ip_vs_est.c\n@@ -68,6 +68,10 @@\n and the limit of estimators per kthread\n - est_add_ktid: ktid where to add new ests, can point to empty slot where\n we should add kt data\n+ - data protected by service_mutex: est_temp_list, est_add_ktid\n+ - data protected by est_mutex: est_kt_count, est_kt_arr, est_max_threads,\n+ sysctl_est_cpulist, est_cpulist_valid, sysctl_est_nice, est_stopped,\n+ sysctl_run_estimation\n */\n \n static struct lock_class_key __ipvs_est_key;\n@@ -229,6 +233,8 @@ static int ip_vs_estimation_kthread(void *data)\n /* Schedule stop/start for kthread tasks */\n void ip_vs_est_reload_start(struct netns_ipvs *ipvs)\n {\n+\tlockdep_assert_held(&ipvs->est_mutex);\n+\n \t/* Ignore reloads before first service is added */\n \tif (!READ_ONCE(ipvs->enable))\n \t\treturn;\n@@ -304,12 +310,17 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)\n \tvoid *arr = NULL;\n \tint i;\n \n-\tif ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&\n-\t READ_ONCE(ipvs->enable) && ipvs->est_max_threads)\n-\t\treturn -EINVAL;\n-\n \tmutex_lock(&ipvs->est_mutex);\n \n+\t/* Allow kt 0 data to be created before the services are added\n+\t * and limit the kthreads when services are present.\n+\t */\n+\tif ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&\n+\t READ_ONCE(ipvs->enable) && ipvs->est_max_threads) {\n+\t\tret = -EINVAL;\n+\t\tgoto out;\n+\t}\n+\n \tfor (i = 0; i < id; i++) {\n \t\tif (!ipvs->est_kt_arr[i])\n \t\t\tbreak;\n@@ -485,9 +496,6 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)\n \tstruct ip_vs_estimator *est = &stats->est;\n \tint ret;\n \n-\tif (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))\n-\t\tipvs->est_max_threads = ip_vs_est_max_threads(ipvs);\n-\n \test->ktid = -1;\n \test->ktrow = IPVS_EST_NTICKS - 1;\t/* Initial delay */\n \n", "prefixes": [ "net" ] }