Re: [PATCH net 02/15] ipvs: wait grace period while reusing dest from trash

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Tue, 3 Nov 2026, Pablo Neira Ayuso wrote:

> From: Darong Lu <zzyy19904204639@163.com>
> 
> Darong Lu and the VEGA team report a problem with the TWOS scheduler
> that manifests as a loop while traversing the list of destinations. The
> problem occurs if destinations are removed and re-added through the
> destination trash before an RCU grace period has elapsed. As destinations
> are re-added to a new service, CPUs traversing the old destination list
> may never reach the old list head and fail to terminate.
> 
> As the problem is not specific to the TWOS scheduler, use a general
> solution. Jiayuan Chen provided an initial solution based on
> get_state_synchronize_rcu() and cond_synchronize_rcu(), where the grace
> period cookie is saved after a destination is unlinked and moved into the
> destination trash. cond_synchronize_rcu() then ensures the grace period
> before the destination is reused.
> 
> Use a temporary list for destinations removed together from a service or
> during a flush. A single get_state_synchronize_rcu() call records the
> cookie for all destinations before the temporary list is spliced into the
> public destination trash. This also limits destination-trash locking to
> one acquisition for bulk removal.
> 
> Destination edits that remove and re-add an entry to the real-server hash
> table use the same grace-period mechanism. Destinations returned to the
> trash after an estimator failure are put back without recording a new
> cookie.
> 
> Fixes: ceec4c381681 ("ipvs: convert services to rcu")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Reported-by: Darong Lu <zzyy19904204639@163.com>
> Link: https://patch.msgid.link/cover.1789117690.git.zzyy19904204639@163.com/
> Co-developed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> Signed-off-by: Darong Lu <zzyy19904204639@163.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  include/net/ip_vs.h            |   4 +-
>  net/netfilter/ipvs/ip_vs_ctl.c | 109 ++++++++++++++++++++++++++-------
>  2 files changed, 90 insertions(+), 23 deletions(-)
> 

> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index ce9fe20d6106..7f10cf5b48c7 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c

> @@ -1566,11 +1615,18 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
>  
>  		ret = ip_vs_start_estimator(svc->ipvs, &dest->stats);
>  		/* On error put back dest into the trash */
> -		if (ret < 0)
> -			ip_vs_trash_put_dest(svc->ipvs, dest, dest->idle_start,
> -					     false);
> -		else
> +		if (ret < 0) {
> +			ip_vs_trash_put_back(svc->ipvs, dest);
> +		} else {
> +			/* Readers may still follow the n_list/d_list of the
> +			 * unlinked dest, wait before linking it again.
> +			 */
> +			cond_synchronize_rcu(dest->rcu_state);
> +			/* need_gp matters only on dest edit, reinit it */
> +			dest->need_gp = 0;
> +
>  			__ip_vs_update_dest(svc, dest, udest, 1);
> +		}

	BTW, this patch needs a little fix above:

https://sashiko.dev/#/patchset/20261102005654.532438-1-pablo%40netfilter.org

	I'll post more info soon.

Regards

--
Julian Anastasov <ja@ssi.bg>