bpf: avoid race when selecting the RevSNAT port #33115
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The logic to allocate SNAT mapping contains a race condition.
At a high level it does the following:
if (!revsnat_exists(port)) {
if (!create_revsnat(port)
return error;
...
}
Two concurrent executions of the datapath may succeed the
revsnat_exists check, which then leads to one of them bailing
out since create_revsnat fails.
Instead simply try to create the RevSNAT entry. If that fails we
retry with another port.
Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
|
/test |
3 tasks
julianwiedmann
approved these changes
Jun 13, 2024
|
/test |
I had a look, this is present even in the first version 0e785f9 which appeared in 1.5.0. There were a couple of changes in between, so the backport would have to be manual. I'll leave it up to you to decide - maybe it makes sense to see whether this helps the user with their symptoms? |
Ack, sounds good. Let's release-note it as bug, but hold off on backports until we see if it helps. |
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The logic to allocate SNAT mapping contains a race condition. At a high level it does the following:
Two concurrent executions of the datapath may succeed the revsnat_exists check, which then leads to one of them bailing out since create_revsnat fails.
Instead simply try to create the RevSNAT entry. If that fails we retry with another port.
Updates: #33074