iptables: Fix data race in iptables manager #35902
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 tasks
66ce916 to
a34b45c
Compare
This comment was marked as outdated.
This comment was marked as outdated.
a34b45c to
99bdb73
Compare
This comment was marked as outdated.
This comment was marked as outdated.
gentoo-root
approved these changes
Nov 12, 2024
The haveIp6tables parameter is initially set to true, but its
initialization is completed in the manager Start hook. That hook is
executed in its onw goroutine, while another one runs the iptables
reconciler oneshot job. Those two goroutines may run concurrently thus
leading to a data race when accessing the haveIp6tables parameter.
Since that parameter enables or disable the support for IPv6 rules, we
must enforce an ordering between the two goroutines, specifically we
must force the reconciler to wait for the initialization to be
completed.
Therefore, use a wait group to force the reconciler to wait for both the
ip{4,6}tables wait arguments and haveIp6tables config parameter to be
fully initialized.
Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
99bdb73 to
a6ebb32
Compare
|
/test |
14 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The haveIp6tables parameter is initially set to true, but its initializiation is completed in the manager Start hook. That hook is executed in its onw goroutine, while another one runs the iptables reconciler oneshot job. Those two goroutines may run concurrently thus leading to a data race when accessing the haveIp6tables parameter.
Since that parameter enables or disable the support for IPv6 rules, we must enforce an ordering between the two goroutines, specifically we must force the reconciler to wait for the initialization to be completed.
Therefore, use a wait group to force the reconciler to wait for both the ip{4,6}tables wait arguments and haveIp6tables config parameter to be fully initialized.