Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2196519/?format=api
{ "id": 2196519, "url": "http://patchwork.ozlabs.org/api/patches/2196519/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260214145850.18130-3-ja@ssi.bg/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260214145850.18130-3-ja@ssi.bg>", "list_archive_url": null, "date": "2026-02-14T14:58:50", "name": "[nf,2/2] ipvs: do not keep dest_dst if dev is going down", "commit_ref": null, "pull_url": null, "state": "under-review", "archived": false, "hash": "1a97447f0d7601fabb9438c70753cc34f858fc7e", "submitter": { "id": 2825, "url": "http://patchwork.ozlabs.org/api/people/2825/?format=api", "name": "Julian Anastasov", "email": "ja@ssi.bg" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260214145850.18130-3-ja@ssi.bg/mbox/", "series": [ { "id": 492176, "url": "http://patchwork.ozlabs.org/api/series/492176/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=492176", "date": "2026-02-14T14:58:50", "name": "IPVS changes, part 1 of 4 - fixes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/492176/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2196519/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2196519/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-10769-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=ssi.bg header.i=@ssi.bg header.a=rsa-sha256\n header.s=ssi header.b=bminM2jV;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-10769-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=\"bminM2jV\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=193.238.174.39", "smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=ssi.bg" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fCsjM5RGNz1xwj\n\tfor <incoming@patchwork.ozlabs.org>; Sun, 15 Feb 2026 02:03:03 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id A376F3020D74\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 14 Feb 2026 15:02:56 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 68852273D8F;\n\tSat, 14 Feb 2026 15:02:55 +0000 (UTC)", "from mx.ssi.bg (mx.ssi.bg [193.238.174.39])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id DF8731DA62E;\n\tSat, 14 Feb 2026 15:02:49 +0000 (UTC)", "from mx.ssi.bg (localhost [127.0.0.1])\n\tby mx.ssi.bg (Potsfix) with ESMTP id E20DC21D6A;\n\tSat, 14 Feb 2026 17:02:46 +0200 (EET)", "from box.ssi.bg (box.ssi.bg [193.238.174.46])\n\tby mx.ssi.bg (Potsfix) with ESMTPS;\n\tSat, 14 Feb 2026 17:02:45 +0200 (EET)", "from ja.ssi.bg (unknown [213.16.62.126])\n\tby box.ssi.bg (Potsfix) with ESMTPSA id 6255C609BE;\n\tSat, 14 Feb 2026 17:02:45 +0200 (EET)", "from ja.home.ssi.bg (localhost.localdomain [127.0.0.1])\n\tby ja.ssi.bg (8.18.1/8.18.1) with ESMTP id 61EExQeU018159;\n\tSat, 14 Feb 2026 16:59:26 +0200", "(from root@localhost)\n\tby ja.home.ssi.bg (8.18.1/8.18.1/Submit) id 61EExQ8Q018158;\n\tSat, 14 Feb 2026 16:59:26 +0200" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1771081374; cv=none;\n b=B/xZ3x7MGIGU/p357eIFhiXA/Yyv8R9emGLg6pYISstx/8DdeZqjlrYSbd3jNplTtM+SeqYsI9z3BUgwaM0N5kyhfqouooYfJ///gn0z1kiAQijxOjMUyowzOZJ+QFPP8xf2n524HYV16HmyTm/X+zdq+hZHrNbDsi9zF2aoTyI=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1771081374; c=relaxed/simple;\n\tbh=bUJ2/NUoi4gA+6dl0HVCjfpN5T6IjvL4MwfSVRanpwY=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=p5MbSJnebMajY4m2XzrMrv1sWSFreSz9xOdo0BlJyc2OlrmLobwwfamvn8/G+zwKAMVmMxpPM1L/9R39naTx3NOTT8PWnu8fVGgcn+pXIDunYROFmUwe96mQRGcKmubV11kgQKSCJIGpElAijHTx/SlSfAO0P9OkE+rQ3LdjHOk=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg;\n spf=pass smtp.mailfrom=ssi.bg;\n dkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=bminM2jV;\n arc=none smtp.client-ip=193.238.174.39", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ssi.bg; h=cc:cc\n\t:content-transfer-encoding:date:from:from:in-reply-to:message-id\n\t:mime-version:references:reply-to:subject:subject:to:to; s=ssi;\n\t bh=m28j557dyzS+Eb3mAHQeLNi4x1G/+PYAORs4hd4EMPo=; b=bminM2jVyS3t\n\tovnJDBGI7+Uy9lnXrUqrI0KpRi4GvQ4BPnTZm0I2WoaaWe3K9sV14XJLycIzV3hF\n\tzVb0IQbOZ5Dfce9NvtL27Au9WQiw4+4GocWCOmHQoCzYdMg5exdQtnXbv5xQsqpH\n\tLTya6cZT8KtE+SEYKvvdazL/cTzIloQG5mUwMzM0DUNaaJy6Va9F6GyMcIhKzzUj\n\t1qdsP3cZn+uchGJXW/tZ27c0ajyvkm379rwpthW+LzD0ymPbyBMkNRlkl0U8wVaT\n\tmIdwmNju9RksxV+1hM3GXYsMAmzLxsHWZRmt6vGj4vMxhNdVDv8kaxUhcnZhfXcR\n\t7Lt777pqhj0d0gDKA2e58xb26f1rrhUapblDsSalO7SluX2ivFEZZWkx3EZ8/Yy0\n\tK527yZgPxXqQBLt3APn8TMMhTULyyT+idLmwaeeH+dEUy33kX7qq8AeSUxQCJpI1\n\t0RzRxAP+aMbgwQpxNbfXvV2XmDLM8IP20ZCkndmctD5PMfkNWigxRZk7dLuk+bo/\n\tElPULgDHSmlc32E1laqjDZMjisTQE9nQWZ9n5xWoTaAHyio4WWnqy1rzmxmngJli\n\tQR4pv2d1/oj70u9BgKMCQBh2VLyu/Fz/w1Llb0ArE2UFQll+0CeUXEJaANkcgJLY\n\tWVpknRfFKfqfLzqfMsnJ0wE36E/KJM8=", "From": "Julian Anastasov <ja@ssi.bg>", "To": "Simon Horman <horms@verge.net.au>", "Cc": "Pablo Neira Ayuso <pablo@netfilter.org>, lvs-devel@vger.kernel.org,\n netfilter-devel@vger.kernel.org, Dust Li <dust.li@linux.alibaba.com>,\n Jiejian Wu <jiejian@linux.alibaba.com>", "Subject": "[PATCH nf 2/2] ipvs: do not keep dest_dst if dev is going down", "Date": "Sat, 14 Feb 2026 16:58:50 +0200", "Message-ID": "<20260214145850.18130-3-ja@ssi.bg>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260214145850.18130-1-ja@ssi.bg>", "References": "<20260214145850.18130-1-ja@ssi.bg>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "There is race between the netdev notifier ip_vs_dst_event()\nand the code that caches dst with dev that is going down.\nAs the FIB can be notified for the closed device after our\nhandler finishes, it is possible valid route to be returned\nand cached resuling in a leaked dev reference until the dest\nis not removed.\n\nTo prevent new dest_dst to be attached to dest just after the\nhandler dropped the old one, add a netif_running() check\nto make sure the notifier handler is not currently running\nfor device that is closing.\n\nFixes: 7a4f0761fce3 (\"IPVS: init and cleanup restructuring\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\n---\n net/netfilter/ipvs/ip_vs_xmit.c | 46 ++++++++++++++++++++++++++-------\n 1 file changed, 36 insertions(+), 10 deletions(-)", "diff": "diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c\nindex 64c697212578..124f779424b0 100644\n--- a/net/netfilter/ipvs/ip_vs_xmit.c\n+++ b/net/netfilter/ipvs/ip_vs_xmit.c\n@@ -294,6 +294,12 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,\n \treturn true;\n }\n \n+/* rt has device that is down */\n+static bool rt_dev_is_down(const struct net_device *dev)\n+{\n+\treturn dev && !netif_running(dev);\n+}\n+\n /* Get route to destination or remote server */\n static int\n __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,\n@@ -309,9 +315,11 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,\n \n \tif (dest) {\n \t\tdest_dst = __ip_vs_dst_check(dest);\n-\t\tif (likely(dest_dst))\n+\t\tif (likely(dest_dst)) {\n \t\t\trt = dst_rtable(dest_dst->dst_cache);\n-\t\telse {\n+\t\t\tif (ret_saddr)\n+\t\t\t\t*ret_saddr = dest_dst->dst_saddr.ip;\n+\t\t} else {\n \t\t\tdest_dst = ip_vs_dest_dst_alloc();\n \t\t\tspin_lock_bh(&dest->dst_lock);\n \t\t\tif (!dest_dst) {\n@@ -327,14 +335,22 @@ __ip_vs_get_out_rt(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,\n \t\t\t\tip_vs_dest_dst_free(dest_dst);\n \t\t\t\tgoto err_unreach;\n \t\t\t}\n-\t\t\t__ip_vs_dst_set(dest, dest_dst, &rt->dst, 0);\n+\t\t\t/* It is forbidden to attach dest->dest_dst if\n+\t\t\t * device is going down.\n+\t\t\t */\n+\t\t\tif (!rt_dev_is_down(dst_dev_rcu(&rt->dst)))\n+\t\t\t\t__ip_vs_dst_set(dest, dest_dst, &rt->dst, 0);\n+\t\t\telse\n+\t\t\t\tnoref = 0;\n \t\t\tspin_unlock_bh(&dest->dst_lock);\n \t\t\tIP_VS_DBG(10, \"new dst %pI4, src %pI4, refcnt=%d\\n\",\n \t\t\t\t &dest->addr.ip, &dest_dst->dst_saddr.ip,\n \t\t\t\t rcuref_read(&rt->dst.__rcuref));\n+\t\t\tif (ret_saddr)\n+\t\t\t\t*ret_saddr = dest_dst->dst_saddr.ip;\n+\t\t\tif (!noref)\n+\t\t\t\tip_vs_dest_dst_free(dest_dst);\n \t\t}\n-\t\tif (ret_saddr)\n-\t\t\t*ret_saddr = dest_dst->dst_saddr.ip;\n \t} else {\n \t\tnoref = 0;\n \n@@ -471,9 +487,11 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,\n \n \tif (dest) {\n \t\tdest_dst = __ip_vs_dst_check(dest);\n-\t\tif (likely(dest_dst))\n+\t\tif (likely(dest_dst)) {\n \t\t\trt = dst_rt6_info(dest_dst->dst_cache);\n-\t\telse {\n+\t\t\tif (ret_saddr)\n+\t\t\t\t*ret_saddr = dest_dst->dst_saddr.in6;\n+\t\t} else {\n \t\t\tu32 cookie;\n \n \t\t\tdest_dst = ip_vs_dest_dst_alloc();\n@@ -494,14 +512,22 @@ __ip_vs_get_out_rt_v6(struct netns_ipvs *ipvs, int skb_af, struct sk_buff *skb,\n \t\t\t}\n \t\t\trt = dst_rt6_info(dst);\n \t\t\tcookie = rt6_get_cookie(rt);\n-\t\t\t__ip_vs_dst_set(dest, dest_dst, &rt->dst, cookie);\n+\t\t\t/* It is forbidden to attach dest->dest_dst if\n+\t\t\t * device is going down.\n+\t\t\t */\n+\t\t\tif (!rt_dev_is_down(dst_dev_rcu(&rt->dst)))\n+\t\t\t\t__ip_vs_dst_set(dest, dest_dst, &rt->dst, cookie);\n+\t\t\telse\n+\t\t\t\tnoref = 0;\n \t\t\tspin_unlock_bh(&dest->dst_lock);\n \t\t\tIP_VS_DBG(10, \"new dst %pI6, src %pI6, refcnt=%d\\n\",\n \t\t\t\t &dest->addr.in6, &dest_dst->dst_saddr.in6,\n \t\t\t\t rcuref_read(&rt->dst.__rcuref));\n+\t\t\tif (ret_saddr)\n+\t\t\t\t*ret_saddr = dest_dst->dst_saddr.in6;\n+\t\t\tif (!noref)\n+\t\t\t\tip_vs_dest_dst_free(dest_dst);\n \t\t}\n-\t\tif (ret_saddr)\n-\t\t\t*ret_saddr = dest_dst->dst_saddr.in6;\n \t} else {\n \t\tnoref = 0;\n \t\tdst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm,\n", "prefixes": [ "nf", "2/2" ] }