linux-kernel - Re: [PATCH v2] ipvs: Check ipvs->enable before unregistration in __ip_vs_ftp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5d3aae32-1c81-05fb-f210-29ec864c4f6d@ssi.bg>
Date: Wed, 10 Sep 2025 12:39:07 +0300 (EEST)
From: Julian Anastasov <ja@....bg>
To: Slavin Liu <slavin452@...il.com>
cc: Simon Horman <horms@...ge.net.au>, Pablo Neira Ayuso <pablo@...filter.org>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>,
        "David S . Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, lvs-devel@...r.kernel.org,
        netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ipvs: Check ipvs->enable before unregistration in
 __ip_vs_ftp_exit()


	Hello,

On Wed, 10 Sep 2025, Slavin Liu wrote:

> On netns cleanup path, before unregistration in __ip_vs_ftp_exit(),
> there could still be existing conns with valid cp->app.
> 
> Suggested by Julian, this patch fixes this issue by checking ipvs->enable 
> to ensure the right order of cleanup:
> 1. Set ipvs->enable to 0 in ipvs_core_dev_ops->exit_batch()
> 2. Skip app unregistration in ip_vs_ftp_ops->exit() by 
> 	checking ipvs->enable
> 3. Flush all conns in ipvs_core_ops->exit_batch()
> 4. Unregister all apps in ipvs_core_ops->exit_batch()
> 
> Access ipvs->enable by READ_ONCE to avoid concurrency issue.
> 
> Suggested-by: Julian Anastasov <ja@....bg>
> Signed-off-by: Slavin Liu <slavin452@...il.com>
> ---
>  net/netfilter/ipvs/ip_vs_ftp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
> index d8a284999544..d3e2f7798bf3 100644
> --- a/net/netfilter/ipvs/ip_vs_ftp.c
> +++ b/net/netfilter/ipvs/ip_vs_ftp.c
> @@ -605,7 +605,7 @@ static void __ip_vs_ftp_exit(struct net *net)
>  {
>  	struct netns_ipvs *ipvs = net_ipvs(net);
>  
> -	if (!ipvs)
> +	if (!ipvs || !READ_ONCE(ipvs->enable))

	Ops, I forgot that ipvs->enable is set later when
service is added. May be we have to add some new global flag
for this in ip_vs_ftp.c:

static bool removing;

	We will set it in ip_vs_ftp_exit() before calling
unregister_pernet_subsys() and the above check will become:

	if (!ipvs || !removing)

	Also, we have to add Fixes tag, this looks the
one that starts to remove apps from netns exit handler:

Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")

Regards

--
Julian Anastasov <ja@....bg>