Hello,
On Tue, 3 Nov 2026, Pablo Neira Ayuso wrote:
From: Darong Lu <redacted>
Darong Lu and the VEGA team report a problem with the TWOS scheduler
that manifests as a loop while traversing the list of destinations. The
problem occurs if destinations are removed and re-added through the
destination trash before an RCU grace period has elapsed. As destinations
are re-added to a new service, CPUs traversing the old destination list
may never reach the old list head and fail to terminate.
As the problem is not specific to the TWOS scheduler, use a general
solution. Jiayuan Chen provided an initial solution based on
get_state_synchronize_rcu() and cond_synchronize_rcu(), where the grace
period cookie is saved after a destination is unlinked and moved into the
destination trash. cond_synchronize_rcu() then ensures the grace period
before the destination is reused.
Use a temporary list for destinations removed together from a service or
during a flush. A single get_state_synchronize_rcu() call records the
cookie for all destinations before the temporary list is spliced into the
public destination trash. This also limits destination-trash locking to
one acquisition for bulk removal.
Destination edits that remove and re-add an entry to the real-server hash
table use the same grace-period mechanism. Destinations returned to the
trash after an estimator failure are put back without recording a new
cookie.
Fixes: ceec4c381681 ("ipvs: convert services to rcu")
Cc: <redacted>
Reported-by: Vega <redacted>
Reported-by: Darong Lu <redacted>
Link: https://patch.msgid.link/cover.1789117690.git.zzyy19904204639@163.com/ (local)
Co-developed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Darong Lu <redacted>
Signed-off-by: Ren Wei <redacted>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/ip_vs.h | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 109 ++++++++++++++++++++++++++-------
2 files changed, 90 insertions(+), 23 deletions(-)
quoted hunk ↗ jump to hunk
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ce9fe20d6106..7f10cf5b48c7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
quoted hunk ↗ jump to hunk
@@ -1566,11 +1615,18 @@ ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
ret = ip_vs_start_estimator(svc->ipvs, &dest->stats);
/* On error put back dest into the trash */
- if (ret < 0)
- ip_vs_trash_put_dest(svc->ipvs, dest, dest->idle_start,
- false);
- else
+ if (ret < 0) {
+ ip_vs_trash_put_back(svc->ipvs, dest);
+ } else {
+ /* Readers may still follow the n_list/d_list of the
+ * unlinked dest, wait before linking it again.
+ */
+ cond_synchronize_rcu(dest->rcu_state);
+ /* need_gp matters only on dest edit, reinit it */
+ dest->need_gp = 0;
+
__ip_vs_update_dest(svc, dest, udest, 1);
+ }
BTW, this patch needs a little fix above:
https://sashiko.dev/#/patchset/20261102005654.532438-1-pablo%40netfilter.org
I'll post more info soon.
Regards
--
Julian Anastasov [off-list ref]