Re: [PATCHv6 net-next 03/14] ipvs: some service readers can use RCU

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Julian,

Comments below.

On Sun, Oct 19, 2025 at 06:57:00PM +0300, Julian Anastasov wrote:
> Some places walk the services under mutex but they can just use RCU:
> 
> * ip_vs_dst_event() uses ip_vs_forget_dev() which uses its own lock
>   to modify dest
> * ip_vs_genl_dump_services(): ip_vs_genl_fill_service() just fills skb
> * ip_vs_genl_parse_service(): move RCU lock to callers
>   ip_vs_genl_set_cmd(), ip_vs_genl_dump_dests() and ip_vs_genl_get_cmd()
> * ip_vs_genl_dump_dests(): just fill skb
> 
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
> ---
>  net/netfilter/ipvs/ip_vs_ctl.c | 47 +++++++++++++++++-----------------
>  1 file changed, 23 insertions(+), 24 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 2fb9034b4f53..b18d08d79bcb 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1759,23 +1759,21 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
>  	if (event != NETDEV_DOWN || !ipvs)
>  		return NOTIFY_DONE;
>  	IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
> -	mutex_lock(&ipvs->service_mutex);
> +	rcu_read_lock();

Control plane can still add destinations to svc->destinations that can
be skipped by the rcu walk. I think it should be possible to trigger
leaks with a sufficiently large list, given concurrent updates can
happen. ip_vs_forget_dev() has its own lock, but this is a per-dest
lock which is taken during the list walk.

>  	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
> -		hlist_for_each_entry(svc, &ipvs->svc_table[idx], s_list) {
> -			list_for_each_entry(dest, &svc->destinations,
> -					    n_list) {
> +		hlist_for_each_entry_rcu(svc, &ipvs->svc_table[idx], s_list)
> +			list_for_each_entry_rcu(dest, &svc->destinations,
> +						n_list)
>  				ip_vs_forget_dev(dest, dev);
> -			}
> -		}
>  
> -		hlist_for_each_entry(svc, &ipvs->svc_fwm_table[idx], f_list) {
> -			list_for_each_entry(dest, &svc->destinations,
> -					    n_list) {
> +		hlist_for_each_entry_rcu(svc, &ipvs->svc_fwm_table[idx], f_list)
> +			list_for_each_entry_rcu(dest, &svc->destinations,
> +						n_list)
>  				ip_vs_forget_dev(dest, dev);
> -			}
> -		}
>  	}
> +	rcu_read_unlock();
>  
> +	mutex_lock(&ipvs->service_mutex);
>  	spin_lock_bh(&ipvs->dest_trash_lock);
>  	list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
>  		ip_vs_forget_dev(dest, dev);
> @@ -3318,9 +3316,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
>  			goto nla_put_failure;
>  	}
>  
> -	sched = rcu_dereference_protected(svc->scheduler, 1);
> +	sched = rcu_dereference(svc->scheduler);
>  	sched_name = sched ? sched->name : "none";
> -	pe = rcu_dereference_protected(svc->pe, 1);
> +	pe = rcu_dereference(svc->pe);
>  	if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
>  	    (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
>  	    nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
> @@ -3374,9 +3372,9 @@ static int ip_vs_genl_dump_services(struct sk_buff *skb,
>  	struct net *net = sock_net(skb->sk);
>  	struct netns_ipvs *ipvs = net_ipvs(net);
>  
> -	mutex_lock(&ipvs->service_mutex);
> +	rcu_read_lock();

Here I can see this is safe, because this is netlink path.

>  	for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
> -		hlist_for_each_entry(svc, &ipvs->svc_table[i], s_list) {
> +		hlist_for_each_entry_rcu(svc, &ipvs->svc_table[i], s_list) {
>  			if (++idx <= start)
>  				continue;
>  			if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
> @@ -3387,7 +3385,7 @@ static int ip_vs_genl_dump_services(struct sk_buff *skb,
>  	}
>  
>  	for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
> -		hlist_for_each_entry(svc, &ipvs->svc_fwm_table[i], f_list) {
> +		hlist_for_each_entry_rcu(svc, &ipvs->svc_fwm_table[i], f_list) {
>  			if (++idx <= start)
>  				continue;
>  			if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
> @@ -3398,7 +3396,7 @@ static int ip_vs_genl_dump_services(struct sk_buff *skb,
>  	}
>  
>  nla_put_failure:
> -	mutex_unlock(&ipvs->service_mutex);
> +	rcu_read_unlock();
>  	cb->args[0] = idx;
>  
>  	return skb->len;
> @@ -3454,13 +3452,11 @@ static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs,
>  		usvc->fwmark = 0;
>  	}
>  
> -	rcu_read_lock();
>  	if (usvc->fwmark)
>  		svc = __ip_vs_svc_fwm_find(ipvs, usvc->af, usvc->fwmark);
>  	else
>  		svc = __ip_vs_service_find(ipvs, usvc->af, usvc->protocol,
>  					   &usvc->addr, usvc->port);
> -	rcu_read_unlock();
>  	*ret_svc = svc;
>  
>  	/* If a full entry was requested, check for the additional fields */
> @@ -3587,7 +3583,7 @@ static int ip_vs_genl_dump_dests(struct sk_buff *skb,
>  	struct net *net = sock_net(skb->sk);
>  	struct netns_ipvs *ipvs = net_ipvs(net);
>  
> -	mutex_lock(&ipvs->service_mutex);
> +	rcu_read_lock();
>  
>  	/* Try to find the service for which to dump destinations */
>  	if (nlmsg_parse_deprecated(cb->nlh, GENL_HDRLEN, attrs, IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy, cb->extack))
> @@ -3599,7 +3595,7 @@ static int ip_vs_genl_dump_dests(struct sk_buff *skb,
>  		goto out_err;
>  
>  	/* Dump the destinations */
> -	list_for_each_entry(dest, &svc->destinations, n_list) {
> +	list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
>  		if (++idx <= start)
>  			continue;
>  		if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
> @@ -3612,7 +3608,7 @@ static int ip_vs_genl_dump_dests(struct sk_buff *skb,
>  	cb->args[0] = idx;
>  
>  out_err:
> -	mutex_unlock(&ipvs->service_mutex);
> +	rcu_read_unlock();
>  
>  	return skb->len;
>  }
> @@ -3915,9 +3911,12 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
>  	if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
>  		need_full_svc = true;
>  
> +	/* We use function that requires RCU lock */
> +	rcu_read_lock();

This is ip_vs_genl_set_cmd path and the new per-netns mutex is held.

I think __ip_vs_service_find() can now just access this mutex to check
if it is held, using fourth parameter:

        list_for_each_entry_rcu(..., lockdep_is_held(&ipvs->service_mutex))

Then this rcu_read_lock() after mutex_lock(&ipvs->service_mutex) can
be removed. I suspect you added it to quiet a rcu debugging splat.

>  	ret = ip_vs_genl_parse_service(ipvs, &usvc,
>  				       info->attrs[IPVS_CMD_ATTR_SERVICE],
>  				       need_full_svc, &svc);
> +	rcu_read_unlock();
>  	if (ret)
>  		goto out;
>