Re: [PATCH] ipvs: Avoid unnecessary calls to skb_is_gso_sctp

;commit" word: Ref: commit e10d3ba4d434 ("ipvs: Fix checksumming on GSO of SCTP packets") > Signed-off-by: Ismael Luceno Looks good to me for nf-next, thanks! Acked-by: Julian Anastasov > CC: Pablo Neira Ayuso > CC: Michal Kubeček > CC: Simon Horman > CC: Julian A

Re: [PATCH v4 2/2] ipvs: allow some sysctls in non-init user namespaces

es/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 > [2] > Link: > https://github.com/moby/libnetwork/blob/3797618f9a38372e8107d8c06f6ae199e1133ae8/osl/namespace_linux.go#L682 > [3] > > Cc: Julian Anastasov > Cc: Simon Hor

Re: [PATCH v4 1/2] ipvs: add READ_ONCE barrier for ipvs->sysctl_amemthresh

Hello, On Mon, 6 May 2024, Alexander Mikhalitsyn wrote: > Cc: Julian Anastasov > Cc: Simon Horman > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Suggested-by: Julian Anastasov > Signed-off-by: Alexander Mikhalitsyn Looks go

Re: [PATCH net-next v3 2/2] ipvs: allow some sysctls in non-init user namespaces

es/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 > [2] > Link: > https://github.com/moby/libnetwork/blob/3797618f9a38372e8107d8c06f6ae199e1133ae8/osl/namespace_linux.go#L682 > [3] > > Cc: Stéphane Graber > Cc: Christian Brauner &

Re: [PATCH v3] ipvs: Fix checksumming on GSO of SCTP packets

when using GSO. > > Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02) > Co-developed-by: Firo Yang > Signed-off-by: Ismael Luceno > Tested-by: Andreas Taschner > CC: Michal Kubeček > CC: Simon Horman > CC: Julian Anastasov > CC: lvs-de...@vger.kernel

Re: [PATCH v2] ipvs: Fix checksumming on GSO of SCTP packets

when using GSO. > > Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02) > Co-developed-by: Firo Yang > Signed-off-by: Ismael Luceno > Tested-by: Andreas Taschner > CC: Michal Kubeček > CC: Simon Horman > CC: Julian Anastasov > CC: lvs-de...@vger.kernel

Re: [PATCH] ipvs: Fix checksumming on GSO of SCTP packets

Hello, On Sun, 21 Apr 2024, Ismael Luceno wrote: > On 21/Apr/2024 14:01, Julian Anastasov wrote: > > > I'm guessing what should be the Fixes line, may be?: > > > > Fixes: 90017accff61 ("sctp: Add GSO support") > > This seems like th

Re: [PATCH net-next v3 2/2] ipvs: allow some sysctls in non-init user namespaces

es/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 > [2] > Link: > https://github.com/moby/libnetwork/blob/3797618f9a38372e8107d8c06f6ae199e1133ae8/osl/namespace_linux.go#L682 > [3] > > Cc: Stéphane Graber > Cc: Christian Brauner &

Re: [PATCH net-next v3 1/2] ipvs: add READ_ONCE barrier for ipvs->sysctl_amemthresh

Hello, On Thu, 18 Apr 2024, Alexander Mikhalitsyn wrote: > Cc: Julian Anastasov > Cc: Simon Horman > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Suggested-by: Julian Anastasov > Signed-off-by: Alexander Mikhalitsyn Loo

Re: [PATCH] ipvs: Fix checksumming on GSO of SCTP packets

when using GSO. > > Co-developed-by: Firo Yang > Signed-off-by: Ismael Luceno > Tested-by: Andreas Taschner > CC: Michal Kubeček > CC: Simon Horman > CC: Julian Anastasov > CC: lvs-de...@vger.kernel.org > CC: netfilter-de...@vger.kernel.org > CC: net...

Re: [PATCH net-next v2 1/2] ipvs: add READ_ONCE barrier for ipvs->sysctl_amemthresh

Hello, On Thu, 18 Apr 2024, Alexander Mikhalitsyn wrote: > Cc: Julian Anastasov > Cc: Simon Horman > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Suggested-by: Julian Anastasov > Signed-off-by: Alexander Mikhalitsyn > -

Re: [PATCH net-next] ipvs: allow some sysctls in non-init user namespaces

/kubernetes/kubernetes/blob/b722d017a34b300a2284b890448e5a605f21d01e/pkg/proxy/ipvs/proxier.go#L103 > > Cc: Stéphane Graber > Cc: Christian Brauner > Cc: Julian Anastasov > Cc: Simon Horman > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Signed-

Re: [PATCH] ipvs: allow netlink configuration from non-initial user namespace

no memory\n", __func__); > ret = -ENOMEM; > @@ -4139,98 +4139,98 @@ static const struct genl_small_ops ip_vs_genl_ops[] = > { > { > .cmd= IPVS_CMD_NEW_SERVICE, > .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, > - .flags = GENL_ADMIN_PERM, > + .flags = GENL_UNS_ADMIN_PERM, > .doit = ip_vs_genl_set_cmd, ... Regards -- Julian Anastasov

Re: [PATCH net] net: ipvs: avoid stat macros calls from preemptible context

cation Center (linuxtesting.org). > > Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl") > Signed-off-by: Fedor Pchelkin Looks good to me, thanks! Acked-by: Julian Anastasov > --- > net/netfilter/ipvs/ip_vs_xmit.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletion

Re: [PATCH] ipvs: add a stateless type of service and a stateless Maglev hashing scheduler

and as conn can start in established state, we should avoid touching these counters. For UDP ONE_PACKET has no such problem with states but for TCP/SCTP we should take care. Regards -- Julian Anastasov

Re: [PATCH] ipvs: add a stateless type of service and a stateless Maglev hashing scheduler

*need_state ? "true" : "false"); > + } else { > + /* Not SYN packet */ > + final_dest = dests.dest; > + IP_VS_DBG(6, > + "MHS: %s(): Unstable, need_state=%s, > not SYN packet\n", > + __func__, > + *need_state ? "true" : "false"); > + } > + } else if (iph->protocol == IPPROTO_UDP) { > + /* UDP */ > + final_dest = dests.new_dest; > + IP_VS_DBG(6, > + "MHS: %s(): Unstable, need_state=%s, UDP > packet\n", > + __func__, > + *need_state ? "true" : "false"); > + } > + } else { > + /* stable */ > + final_dest = dests.dest; > + IP_VS_DBG(6, > + "MHS: %s(): Stable, need_state=%s\n", > + __func__, > + *need_state ? "true" : "false"); > + } > + return final_dest; > +} > + > +/* IPVS MHS Scheduler structure */ > +static struct ip_vs_scheduler ip_vs_mhs_scheduler = { > + .name ="mhs", > + .refcnt =ATOMIC_INIT(0), > + .module =THIS_MODULE, > + .n_list =LIST_HEAD_INIT(ip_vs_mhs_scheduler.n_list), > + .init_service =ip_vs_mhs_init_svc, > + .done_service =ip_vs_mhs_done_svc, > + .add_dest =ip_vs_mhs_dest_changed, > + .del_dest =ip_vs_mhs_dest_changed, > + .upd_dest =ip_vs_mhs_dest_changed, > + .schedule_sl =ip_vs_mhs_schedule, > +}; > + > +static int __init > +ip_vs_mhs_init(void) > +{ > + return register_ip_vs_scheduler(_vs_mhs_scheduler); > +} > + > +static void __exit > +ip_vs_mhs_cleanup(void) > +{ > + unregister_ip_vs_scheduler(_vs_mhs_scheduler); > + rcu_barrier(); > +} > + > +module_init(ip_vs_mhs_init); > +module_exit(ip_vs_mhs_cleanup); > +MODULE_DESCRIPTION("Stateless Maglev hashing ipvs scheduler"); > +MODULE_LICENSE("GPL"); > +MODULE_AUTHOR("Lev Pantiukhin "); > diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c > b/net/netfilter/ipvs/ip_vs_proto_tcp.c > index 7da51390cea6..31a8c1bfc863 100644 > --- a/net/netfilter/ipvs/ip_vs_proto_tcp.c > +++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c > @@ -38,7 +38,7 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct > sk_buff *skb, > struct ip_vs_iphdr *iph) > { > struct ip_vs_service *svc; > - struct tcphdr _tcph, *th; > + struct tcphdr _tcph, *th = NULL; > __be16 _ports[2], *ports = NULL; > > /* In the event of icmp, we're only guaranteed to have the first 8 > @@ -47,11 +47,8 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct > sk_buff *skb, >*/ > if (likely(!ip_vs_iph_icmp(iph))) { > th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph); > - if (th) { > - if (th->rst || !(sysctl_sloppy_tcp(ipvs) || th->syn)) > - return 1; > + if (th) > ports = >source; > - } > } else { > ports = skb_header_pointer( > skb, iph->len, sizeof(_ports), &_ports); > @@ -74,6 +71,17 @@ tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct > sk_buff *skb, > if (svc) { > int ignored; > > + if (th) { > + /* If sloppy_tcp or IP_VS_SVC_F_STATELESS is true, > + * all SYN packets are scheduled except packets > + * with set RST flag. > + */ > + if (!sysctl_sloppy_tcp(ipvs) && > + !(svc->flags & IP_VS_SVC_F_STATELESS) && > + (!th->syn || th->rst)) > + return 1; > + } Probably same can be done for sctp_conn_schedule() > + > if (ip_vs_todrop(ipvs)) { > /* >* It seems that we are very loaded. > -- > 2.17.1 Regards -- Julian Anastasov

Re: [PATCH net v3] ipvs: fix possible memory leak in ip_vs_control_net_init

* return NULL > when PROC is not used. > > Fixes: b17fc9963f83 ("IPVS: netns, ip_vs_stats and its procfs") > Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") > Reported-by: Hulk Robot > Signed-off-by: Wang Hai Lo

Re: [PATCH net] ipvs: fix possible memory leak in ip_vs_control_net_init

uot;ip_vs_stats_percpu", ipvs->net->proc_net); err_percpu: > + remove_proc_entry("ip_vs_stats", ipvs->net->proc_net); err_stats: > + remove_proc_entry("ip_vs", ipvs->net->proc_net); err_vs: #endif > free_percpu(ipvs->tot_stats.cpustats); > return -ENOMEM; > } > -- Regards -- Julian Anastasov

Re: [PATCH] ipvs: replace atomic_add_return()

Hello, On Mon, 16 Nov 2020, Yejune Deng wrote: > atomic_inc_return() looks better > > Signed-off-by: Yejune Deng Looks good to me for -next, thanks! Acked-by: Julian Anastasov > --- > net/netfilter/ipvs/ip_vs_core.c | 2 +- > net/netfilter/ipvs/ip_vs_sy

Re: [PATCH RFC v3] ipvs: add genetlink cmd to dump all services and destinations

ariables in declarations) - print_service_entry(): no need to check d before free(d), free() checks it itself, just like kfree() in kernel. - ipvs_services_dests_parse_cb: we should stop if realloc() fails, sadly, existing code does not check realloc() result but for new code we should do it - ipvs_get_services_dests(): kernel avoids using assignments in 'if' condition, we do the same for new code. You have to split such code to assignment+condition. - there are extra parentheses in code such as sizeof(*(get->index)), that should be fine instead: sizeof(*get->index), same for sizeof(get->index[0]). Extra parens also for &(get->dests), etc. - as new code runs only for LIBIPVS_USE_NL, check if it is wrapped in proper #ifdef in libipvs/libipvs.c. Make sure ipvsadm compiles without LIBIPVS_USE_NL. - the extern word should not be used in .h files anymore Some of the above styling issues are also reported by linux# scripts/checkpatch.pl --strict /tmp/ipvsadm.patch As we try to apply to ipvsadm the same styling rules that are used for networking in kernel, you should be able to fix all such places with help from checkpatch.pl. Probably, you know about this file: Documentation/process/coding-style.rst Regards -- Julian Anastasov

Re: [PATCH RFC v2] ipvs: add genetlink cmd to dump all services and destinations

svc, )) > + goto nla_put_failure; > + } > + ctx.idx_svc = 0; > + ctx.start_svc = 0; ctx->idx_dest = 0; ctx->start_dest = 0; > + } row = 0;# Not needed tab++; $ tab = 2 to indicate EOF > + > +nla_put_failure: > + cb->args[0] = ctx.idx_svc; > + cb->args[1] = ctx.idx_dest; > + cb->args[2] = tab; > + cb->args[3] = row; > + > +out_err: > + mutex_unlock(&__ip_vs_mutex); > + > + return skb->len; > +} > + > static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest, >struct nlattr *nla, bool full_entry) > { > @@ -3991,6 +4143,12 @@ static const struct genl_small_ops ip_vs_genl_ops[] = { > .flags = GENL_ADMIN_PERM, > .doit = ip_vs_genl_set_cmd, > }, > + { > + .cmd= IPVS_CMD_GET_SERVICE_DEST, > + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, > + .flags = GENL_ADMIN_PERM, > + .dumpit = ip_vs_genl_dump_services_destinations, > + }, > }; > > static struct genl_family ip_vs_genl_family __ro_after_init = { > -- > 2.25.1 Regards -- Julian Anastasov

Re: [PATCH RFC] ipvs: add genetlink cmd to dump all services and destinations

le writing this patch and even > created a few crude validation scripts running parallel agents and > checking the diff in [1]. Ok, make sure your tests cover cases with multiple dests, so that single service occupies multiple packets, I'm not sure if 100 dests fit in one packet or not. Regards -- Julian Anastasov

Re: [PATCH RFC] ipvs: add genetlink cmd to dump all services and destinations

is that we can send duplicates or to skip entries (both svcs and dests). It is impossible to keep any kind of references to current entries or even keys to lookup them if another agent can remove them. > + > + return skb->len; > +} > + > static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest, >struct nlattr *nla, bool full_entry) > { > @@ -3991,6 +4094,12 @@ static const struct genl_small_ops ip_vs_genl_ops[] = { > .flags = GENL_ADMIN_PERM, > .doit = ip_vs_genl_set_cmd, > }, > + { > + .cmd= IPVS_CMD_GET_SERVICE_DEST, > + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, > + .flags = GENL_ADMIN_PERM, > + .dumpit = ip_vs_genl_dump_services_destinations, > + }, > }; > > static struct genl_family ip_vs_genl_family __ro_after_init = { > -- Regards -- Julian Anastasov

Re: [PATCH v5] ipvs: adjust the debug info in function set_tcp_state

Hello, On Mon, 28 Sep 2020, longguang.yue wrote: > Outputting client,virtual,dst addresses info when tcp state changes, > which makes the connection debug more clear > > Signed-off-by: longguang.yue OK, v5 can be used instead of fixing v4. Acked-by: Juli

Re: [PATCH v4] ipvs: adjust the debug info in function set_tcp_state

Hello, On Sun, 27 Sep 2020, longguang.yue wrote: > outputting client,virtual,dst addresses info when tcp state changes, > which makes the connection debug more clear > > Signed-off-by: longguang.yue Looks good to me, thanks! Acked-by: Juli

Re: [PATCHv5 net-next] ipvs: remove dependency on ip6_tables

7 ("ipvs: Fix faulty IPv6 extension header handling in > IPVS"). > Signed-off-by: Yaroslav Bolyukin Looks good to me, thanks! May be maintainers will remove the extra dot after the Fixes line. Acked-by: Julian Anastasov > --- > Missed canonical patch format sectio

Re: [PATCH] Remove ipvs v6 dependency on iptables

IP_VS > config IP_VS_IPV6 > bool "IPv6 support for IPVS" > depends on IPV6 = y || IP_VS = IPV6 > - select IP6_NF_IPTABLES > select NF_DEFRAG_IPV6 > help > Add IPv6 support to IPVS. > -- Regards -- Julian Anastasov

Re: [PATCH] Remove ipvs v6 dependency on iptables

PV6 > - select IP6_NF_IPTABLES > select NF_DEFRAG_IPV6 > help > Add IPv6 support to IPVS. > -- > 2.28.0 Regards -- Julian Anastasov

Re: [Linux-kernel-mentees] [PATCH net-next v2] ipvs: Fix uninit-value in do_ip_vs_set_ctl()

appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2 > Suggested-by: Julian Anastasov > Signed-off-by: Peilin Ye Looks good to me, thanks! Acked-by: Julian Anastasov > --- > Changes in v2: > - Target net-next tree. (Suggested by Julian Anastasov ) > - Reject all `len == 0` requests

Re: [Linux-kernel-mentees] [PATCH net] ipvs: Fix uninit-value in do_ip_vs_set_ctl()

@@ -2547,9 +2549,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user > *user, unsigned int len) > break; > case IP_VS_SO_SET_DELDEST: > ret = ip_vs_del_dest(svc, ); > - break; > - default: > - ret = -EINVAL; > } > >out_unlock: Regards -- Julian Anastasov

Re: [PATCH] ipvs: avoid drop first packet to reuse conntrack

in_icmp_v6(struct netns_ipvs *ipvs, > struct sk_buff *skb, > } > > if (resched) { > + if (uses_ct) > + cp->flags &= ~IP_VS_CONN_F_NFCT; > if (!atomic_read(>n_control)) > ip_vs_conn_expire_now(cp); > __ip_vs_conn_put(cp); > - if (uses_ct) > - return NF_DROP; > cp = NULL; > } > } > -- Regards -- Julian Anastasov

Re: [PATCH] netfilter/ipvs: immediately expire UDP connections matching unavailable destination if expire_nodest_conn=1

f > "then the client program". > Or a more detailed explanation. Yes, if the packet is SYN we can create new connection. If it is ACK, the retransmission will get RST. Regards -- Julian Anastasov

Re: [PATCH] netfilter/ipvs: immediately expire UDP connections matching unavailable destination if expire_nodest_conn=1

le dest, as before - create new connection to available destination that will be found first in lists. But it can work only when sysctl var "conntrack" is 0, we do not want to create two netfilter conntracks to different real servers. Note that we intentionally removed the timer_pending() check because we can not see existing ONE_PACKET connections in table. Regards -- Julian Anastasov

Re: [PATCH] netfilter/ipvs: expire no destination UDP connections when expire_nodest_conn=1

o expire the connection immediately */ > ip_vs_conn_expire_now(cp); > } You can also look at the discussion which resulted in the last patch for this place: http://archive.linuxvirtualserver.org/html/lvs-devel/2018-07/msg00014.html Regards -- Julian Anastasov

Re: [PATCH v3 0/3] selftests: netfilter: introduce test cases for ipvs

. > # ipvs.sh: PASS > ok 6 selftests: netfilter: ipvs.sh > > Haishuang Yan (3): > selftests: netfilter: add ipvs test script > selftests: netfilter: add ipvs nat test case > selftests: netfilter: add ipvs tunnel test case Acked-by: Julian Anastasov > t

Re: [PATCH v2 0/3] selftests: netfilter: introduce test cases for ipvs

| 2 +- > tools/testing/selftests/netfilter/ipvs.sh | 234 > + > 2 files changed, 235 insertions(+), 1 deletion(-) > create mode 100755 tools/testing/selftests/netfilter/ipvs.sh Patchset v2 looks good to me, thanks! Acked-by: Julian Anastasov Regards -- Julian Anastasov

Re: [PATCH v2 0/2] ipvs: speedup ipvs netns dismantle

ip_vs_ctl.c | 12 ++++--- > 3 files changed, 38 insertions(+), 23 deletions(-) Both patches in v2 look good to me, thanks! Acked-by: Julian Anastasov This is for the -next kernels... Regards -- Julian Anastasov

Re: [PATCH 3/3] selftests: netfilter: add ipvs tunnel test case

,12 @@ run_tests() { > test_nat > errors=$(( $errors + $? )) > > + echo "Testing Tunnel mode..." > + cleanup > + setup > + test_tun > + errors=$(( $errors + $? )) > + > return $errors > } > > -- > 1.8.3.1 Regards -- Julian Anastasov

Re: [net-next 1/2] ipvs: batch __ip_vs_cleanup

ip_vs_conn_net_cleanup(ipvs); > >> + ip_vs_app_net_cleanup(ipvs); > >> + ip_vs_protocol_net_cleanup(ipvs); > >> + ip_vs_control_net_cleanup(ipvs); > >> + ip_vs_estimator_net_cleanup(ipvs); > >> + IP_VS_DBG(2, "ipvs netns %d released\n", ipvs->gen); > >> + net->ipvs = NULL; Regards -- Julian Anastasov

Re: [PATCH] [v2 net-next] ipvs: reduce kernel stack usage

%s:%u detected\n", > - IP_VS_DBG_ADDR(cp->af, ), ntohs(port), > - IP_VS_DBG_ADDR(cp->af, >caddr), 0); > + IP_VS_DBG(7, "EPSV response (%pISpc) -> %pISc detected\n", > + IP_VS_DBG_SOCKADDR(cp->af, , port), > + IP_VS_DBG_SOCKADDR(cp->af, >caddr, 0)); > } else { > return 1; > } > @@ -510,15 +510,15 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct > ip_vs_conn *cp, > , , cp->af, > , ) == 1) { > > - IP_VS_DBG_BUF(7, "EPRT %s:%u detected\n", > - IP_VS_DBG_ADDR(cp->af, ), ntohs(port)); > + IP_VS_DBG(7, "EPRT %pISpc detected\n", > + IP_VS_DBG_SOCKADDR(cp->af, , port)); > > /* Now update or create a connection entry for it */ > - IP_VS_DBG_BUF(7, "protocol %s %s:%u %s:%u\n", > - ip_vs_proto_name(ipvsh->protocol), > - IP_VS_DBG_ADDR(cp->af, ), ntohs(port), > - IP_VS_DBG_ADDR(cp->af, >vaddr), > - ntohs(cp->vport)-1); > + IP_VS_DBG(7, "protocol %s %pISpc %pISpc\n", > + ip_vs_proto_name(ipvsh->protocol), > + IP_VS_DBG_SOCKADDR(cp->af, , port), > + IP_VS_DBG_SOCKADDR(cp->af, >vaddr, > + htons(ntohs(cp->vport)-1))); > } else { > return 1; > } > -- > 2.20.0 Regards -- Julian Anastasov

Re: [net-next 1/2] ipvs: batch __ip_vs_cleanup

cleanup(ipvs); > + ip_vs_control_net_cleanup(ipvs); > + ip_vs_estimator_net_cleanup(ipvs); > + IP_VS_DBG(2, "ipvs netns %d released\n", ipvs->gen); > + net->ipvs = NULL; > + } > } Regards -- Julian Anastasov

Re: linux-next: Tree for Jul 3 (netfilter/ipvs/)

isn’t known > struct gre_base_hdr _greh, *greh; > ^ Regards -- Julian Anastasov

Re: [PATCH 4/4] ipvs: reduce kernel stack usage

- ntohs(cp->vport)); > + pr_err("request control DEL for uncontrolled: " > +"%pISp to %pISp\n", ip_vs_dbg_addr() used compact form (%pI6c), so it would be better to use %pISc and %pISpc everywhere in IPVS... Also, note that before now port was printed with %d and ntohs() was used, now port should be in network order, so: - ntohs() should be removed - htons() should be added, if missing. At first look, this case is not present in IPVS, we have only ntohs() usage Regards -- Julian Anastasov

Re: memory leak in start_sync_thread

_ready(); > __kthread_parkme(self); > ret = threadfn(data); > } > > So, apparently the thread parameters must always be owned by the owner of the > kthread, not by the kthread itself. It seems like this would be a common > mistake in kernel code; I'm surprised this doesn't come up more... Thanks! It explains the problem. It was not obvious from the fact that only tinfo was reported as a leak, nothing for tinfo->sock. Moving sock_release to owner complicates the locking but I'll try to fix it in the following days... Regards -- Julian Anastasov

Re: memory leak in nf_hook_entries_grow

_hooks() is called there. > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkal...@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches Regards -- Julian Anastasov

Re: [PATCH v4] ipvs: add checksum support for gue encapsulation

Signed-off-by: Jacky Hu Looks good to me, thanks! Signed-off-by: Julian Anastasov > --- > v4->v3: > 1) defer pd assignment after data += GUE_LEN_PRIV > > v3->v2: > 1) fixed CHECK: spaces preferred around that '<<' (ctx:VxV) > > v2->v1: &

Re: [PATCH v3] ipvs: add checksum support for gue encapsulation

ECKSUM_NONE; > + skb->encapsulation = 0; > + } > + > + *flags |= GUE_PFLAG_REMCSUM; > + data += GUE_PLEN_REMCSUM; > + } > + Regards -- Julian Anastasov

Re: [PATCH v2] ipvs: add checksum support for gue encapsulation

;<1) scripts/checkpatch.pl --strict file.patch reports for some issues you should resolve for v3. Otherwise, the patch looks good to me. Regards -- Julian Anastasov

Re: [PATCH v1] ipvs: add checksum support for gue encapsulation

1208,8 +1297,17 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct > ip_vs_conn *cp, > goto tx_error; > > gso_type = __tun_gso_type_mask(AF_INET6, cp->af); > - if (tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) > - gso_type |= SKB_GSO_UDP_TUNNEL; > + if (tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) { > + if ((tun_flags & IP_VS_TUNNEL_ENCAP_FLAG_CSUM) || > + (tun_flags & IP_VS_TUNNEL_ENCAP_FLAG_REMCSUM)) > + gso_type |= SKB_GSO_UDP_TUNNEL_CSUM; > + else > + gso_type |= SKB_GSO_UDP_TUNNEL; > + if ((tun_flags & IP_VS_TUNNEL_ENCAP_FLAG_REMCSUM) && > + skb->ip_summed == CHECKSUM_PARTIAL) { > + gso_type |= SKB_GSO_TUNNEL_REMCSUM; > + } > + } > > if (iptunnel_handle_offloads(skb, gso_type)) > goto tx_error; > @@ -1218,8 +1316,18 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct > ip_vs_conn *cp, > > skb_set_inner_ipproto(skb, next_protocol); > > - if (tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) > - ipvs_gue_encap(net, skb, cp, _protocol); > + if (tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) { > + bool check = false; > + > + if (ipvs_gue_encap(net, skb, cp, _protocol)) > + goto tx_error; > + > + if ((tun_flags & IP_VS_TUNNEL_ENCAP_FLAG_CSUM) || > + (tun_flags & IP_VS_TUNNEL_ENCAP_FLAG_REMCSUM)) > + check = true; > + > + udp6_set_csum(!check, skb, , >daddr.in6, skb->len); > + } > > skb_push(skb, sizeof(struct ipv6hdr)); > skb_reset_network_header(skb); > -- > 2.21.0 Regards -- Julian Anastasov

Re: [PATCH v2] ipvs: Fix use-after-free in ip_vs_in

> > This patch moves nf_unregister_net_hooks from __ip_vs_cleanup() > to __ip_vs_dev_cleanup(), where rcu_barrier() is called by > unregister_pernet_device -> unregister_pernet_operations, > that will do the needed grace period. > > Reported-by: Hulk Robot > Fixes: e

Re: [PATCH v6] ipvs: allow tunneling with gue encapsulation

l_handle_offloads(skb, __tun_gso_type_mask(AF_INET6, > cp->af))) > + if (tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) > + gso_type = SKB_GSO_UDP_TUNNEL; > + else > + gso_type = __tun_gso_type_mask(AF_INET6, cp->af); Here too > + if (iptunnel_handle_offloads(skb, gso_type)) > goto tx_error; Regards -- Julian Anastasov

Re: [PATCH v3] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()

gt; > Fix this by checking whether the timer already started. > > Signed-off-by: Tan Hu > Reviewed-by: Jiang Biao v3 looks good to me, Acked-by: Julian Anastasov Simon and Pablo, this can be applied to ipvs/nf tree... > --- > v2: fix use-after-free in CONN_ONE_PAC

Re: [PATCH v3] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()

gt; > Fix this by checking whether the timer already started. > > Signed-off-by: Tan Hu > Reviewed-by: Jiang Biao v3 looks good to me, Acked-by: Julian Anastasov Simon and Pablo, this can be applied to ipvs/nf tree... > --- > v2: fix use-after-free in CONN_ONE_PAC

Re: [PATCH v2] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()

x this by checking whether the timer already started. > > Signed-off-by: Tan Hu > Reviewed-by: Jiang Biao > --- > v2: fix use-after-free in CONN_ONE_PACKET case suggested by Julian Anastasov > > net/netfilter/ipvs/ip_vs_core.c | 15 +++ > 1 file changed

Re: [PATCH v2] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()

x this by checking whether the timer already started. > > Signed-off-by: Tan Hu > Reviewed-by: Jiang Biao > --- > v2: fix use-after-free in CONN_ONE_PACKET case suggested by Julian Anastasov > > net/netfilter/ipvs/ip_vs_core.c | 15 +++ > 1 file changed

Re: kernel BUG at lib/string.c:LINE! (4)

1 > Code: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 d2 8f 48 fa eb de > 55 48 89 fe 48 c7 c7 60 65 64 88 48 89 e5 e8 91 dd f3 f9 <0f> 0b 90 90 90 90 > 90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56 > RIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: 8801c976f800 > ---[ end trace 624046f2d9af7702 ]--- Just to let you know that I tested a patch with the syzbot, will do more tests before submitting... Regards -- Julian Anastasov <j...@ssi.bg>

Re: kernel BUG at lib/string.c:LINE! (4)

1 > Code: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 d2 8f 48 fa eb de > 55 48 89 fe 48 c7 c7 60 65 64 88 48 89 e5 e8 91 dd f3 f9 <0f> 0b 90 90 90 90 > 90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56 > RIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: 8801c976f800 > ---[ end trace 624046f2d9af7702 ]--- Just to let you know that I tested a patch with the syzbot, will do more tests before submitting... Regards -- Julian Anastasov

Re: WARNING: possible recursive locking detected

tree, so all these lockups around start_sync_thread should be resolved soon... > > IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = > > 0 > > IPVS: stopping backup sync thread 4546 ... > > > > > > IPVS: stopping backup sync thread 4559 ... > > WARNING: possible recursive locking detected Regards -- Julian Anastasov <j...@ssi.bg>

Re: WARNING: possible recursive locking detected

ead should be resolved soon... > > IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = > > 0 > > IPVS: stopping backup sync thread 4546 ... > > > > > > IPVS: stopping backup sync thread 4559 ... > > WARNING: possible recursive locking detected Regards -- Julian Anastasov

Re: INFO: task hung in stop_sync_thread (2)

e_halt+0x6/0x10 > arch/x86/include/asm/irqflags.h:54 > > > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to syzkal...@googlegroups.com. > > syzbot will keep track of this bug report. > If you forgot to add the Reported-by tag, once the fix for this bug is merged > into any tree, please reply to this email with: > #syz fix: exact-commit-title > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug report. > Note: all commands must start from beginning of the line in the email body. Regards -- Julian Anastasov <j...@ssi.bg>

Re: INFO: task hung in stop_sync_thread (2)

e_halt+0x6/0x10 > arch/x86/include/asm/irqflags.h:54 > > > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to syzkal...@googlegroups.com. > > syzbot will keep track of this bug report. > If you forgot to add the Reported-by tag, once the fix for this bug is merged > into any tree, please reply to this email with: > #syz fix: exact-commit-title > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug report. > Note: all commands must start from beginning of the line in the email body. Regards -- Julian Anastasov

Re: [PATCH] netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed

es: 621e84d6f373 ("dev: introduce skb_scrub_packet()") Signed-off-by: Julian Anastasov <j...@ssi.bg> I guess, DaveM can apply it directly as a bugfix to the net tree. > --- > include/linux/skbuff.h | 7 +++ > net/core/skbuff.c | 1 + > 2 files changed, 8 ins

Re: [PATCH] netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed

a/net/core/skbuff.c b/net/core/skbuff.c > index 2465607..e140ba4 100644 > --- a/net/core/skbuff.c > +++ b/net/core/skbuff.c > @@ -4864,6 +4864,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet) > if (!xnet) > return; > > + ipvs_reset(skb); > skb_orphan(skb); > skb->mark = 0; > } > -- > 1.7.12.4 Regards -- Julian Anastasov

Re: [PATCH] netfilter: ipvs: Convert timers to use timer_setup()

ns...@linux-vs.org> > Cc: Simon Horman <ho...@verge.net.au> > Cc: Julian Anastasov <j...@ssi.bg> > Cc: Pablo Neira Ayuso <pa...@netfilter.org> > Cc: Jozsef Kadlecsik <kad...@blackhole.kfki.hu> > Cc: Florian Westphal <f...@strlen.de> > Cc: "David

Re: [PATCH] netfilter: ipvs: Convert timers to use timer_setup()

; Cc: Simon Horman > Cc: Julian Anastasov > Cc: Pablo Neira Ayuso > Cc: Jozsef Kadlecsik > Cc: Florian Westphal > Cc: "David S. Miller" > Cc: net...@vger.kernel.org > Cc: lvs-de...@vger.kernel.org > Cc: netfilter-de...@vger.kernel.org > Cc: coret...@netfil

Re: [PATCH] ipvs: Fix inappropriate output of procfs

size=4096) > Prot LocalAddress:Port Scheduler Flags > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > TCP 0A010102:0050 wlc > > Signed-off-by: KUWAZAWA Takuya <albatro...@gmail.com> Looks good to me Acked-by: Julian Anastasov <j...@ssi.bg>

Re: [PATCH] ipvs: Fix inappropriate output of procfs

size=4096) > Prot LocalAddress:Port Scheduler Flags > -> RemoteAddress:Port Forward Weight ActiveConn InActConn > TCP 0A010102:0050 wlc > > Signed-off-by: KUWAZAWA Takuya Looks good to me Acked-by: Julian Anastasov Simon, please apply to ipvs tree. >

Re: [PATCH] netfilter: ip_vs_sync: fix bogus maybe-uninitialized warning

works because > the layout is identical, but seems error-prone, so I'm changing > this in the process to directly copy the two members. This change > seemed to have no effect on the object code or the warning, but > it deals with the same data, so I kept the two changes together. > &

Re: [PATCH] netfilter: ip_vs_sync: fix bogus maybe-uninitialized warning

works because > the layout is identical, but seems error-prone, so I'm changing > this in the process to directly copy the two members. This change > seemed to have no effect on the object code or the warning, but > it deals with the same data, so I kept the two changes together. >

Re: [PATCH v2] net: neigh: disallow transition to NUD_STALE if lladdr is unchanged in neigh_update()

edundant, so remove it. > > This change may increase probe traffic, but it's essential since NUD_STALE > lladdr is unreliable. To ensure correctness, we prefer to resolve lladdr, > when we can't get confirmation, even while remote packets try to set > NUD_STALE state. > > Signe

Re: [PATCH v2] net: neigh: disallow transition to NUD_STALE if lladdr is unchanged in neigh_update()

edundant, so remove it. > > This change may increase probe traffic, but it's essential since NUD_STALE > lladdr is unreliable. To ensure correctness, we prefer to resolve lladdr, > when we can't get confirmation, even while remote packets try to set > NUD_STALE state. > > Sign

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

state. If your patch is accepted, I'll post second patch that adds the line with the ADMIN check. As result, the code will look like the example from Yoshifuji Hideaki above. Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

state. If your patch is accepted, I'll post second patch that adds the line with the ADMIN check. As result, the code will look like the example from Yoshifuji Hideaki above. Regards -- Julian Anastasov

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

See above, received broadcast GARP reply can set NUD_STALE. But the most trivial case of GW exposing its IP while looking for other hosts should be the culprit. It probably happens often, that is why we have no chance to send ARP requests, GW is more ARP-active than us and updates our cache and we are happy. Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

See above, received broadcast GARP reply can set NUD_STALE. But the most trivial case of GW exposing its IP while looking for other hosts should be the culprit. It probably happens often, that is why we have no chance to send ARP requests, GW is more ARP-active than us and updates our cache and we are happy. Regards -- Julian Anastasov

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

Hello, On Sat, 23 Jul 2016, Chunhui He wrote: > On Sat, 23 Jul 2016 09:17:59 +0300 (EEST), Julian Anastasov <j...@ssi.bg> > wrote: > > > > What kind of problem is this? Remote host wants to > > see a recent probe from us, otherwise it refuses to reso

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

Hello, On Sat, 23 Jul 2016, Chunhui He wrote: > On Sat, 23 Jul 2016 09:17:59 +0300 (EEST), Julian Anastasov > wrote: > > > > What kind of problem is this? Remote host wants to > > see a recent probe from us, otherwise it refuses to resolve > > our ad

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

nd we may cycle between NUD_STALE and NUD_DELAY if such remote packets come more often. So, the question is, to avoid probes or to refresh frequently? Is there a good reason to ignore this NUD_STALE event in NUD_DELAY | NUD_PROBE state? > NUD_STALE --> NUD_DELAY -(send req again)-> ... --> > NUD_REACHABLE Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

nd we may cycle between NUD_STALE and NUD_DELAY if such remote packets come more often. So, the question is, to avoid probes or to refresh frequently? Is there a good reason to ignore this NUD_STALE event in NUD_DELAY | NUD_PROBE state? > NUD_STALE --> NUD_DELAY -(send req again)-> ... --> > NUD_REACHABLE Regards -- Julian Anastasov

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

new = old; + !(flags & NEIGH_UPDATE_F_ADMIN)) + goto out; } } Any thoughts? Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH] net: neigh: disallow state transition DELAY->STALE in neigh_update()

} else { if (lladdr == neigh->ha && new == NUD_STALE && - ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) || -(old & NUD_CONNECTED)) - ) - new

Re: [PATCH v4 net] ipvs: fix bind to link-local mcast IPv6 address in backup

or the sync daemon") > Signed-off-by: Quentin Armitage <quen...@armitage.org.uk> Looks good to me, thanks! Acked-by: Julian Anastasov <j...@ssi.bg> Simon, please apply to ipvs tree. Patch compiles also on stable 4.4.13, 4.5.7 and 4.6.2, so no need for special

Re: [PATCH v4 net] ipvs: fix bind to link-local mcast IPv6 address in backup

pvs, id); > else > - sock = make_receive_sock(ipvs, id); > + sock = make_receive_sock(ipvs, id, dev->ifindex); > if (IS_ERR(sock)) { > result = PTR_ERR(sock); > goto outtinfo; > -- > 1.7.7.6 Regards -- Julian Anastasov

Re: [PATCH v3 0/4] ipvs: fix backup sync daemon with IPv6, and minor updates

t; > v2 fixes a compile error in a debug message identified by kbuild test > robot. Now compiles with CONFIG_IP_VS_DEBUG enabled. Patch 2/5 is modified > to correct the problem, and patch 3/5 is modifed to apply with the > modified patch 2/5. > > v3 incorporates changes suggested b

Re: [PATCH v3 0/4] ipvs: fix backup sync daemon with IPv6, and minor updates

t; > v2 fixes a compile error in a debug message identified by kbuild test > robot. Now compiles with CONFIG_IP_VS_DEBUG enabled. Patch 2/5 is modified > to correct the problem, and patch 3/5 is modifed to apply with the > modified patch 2/5. > > v3 incorporates changes suggested b

Re: [PATCH v2 0/5] ipvs: fix backup sync daemon with IPv6, and minor updates

t;mcfg.sync_maxlen); <--- 2 TABs ---> But it should be: pr_info("sync thread started: state = MASTER, mcast_ifn = %s, " "syncid = %d, id = %d, maxlen = %d\n", ipvs->mcfg.mcast_ifn, ipvs->mcfg.syncid, tinfo->id, ipvs->mcfg.sync_maxlen); < 1 TAB> Also, the new pr_info calls exceed 80 columns. May be you can reduce the many spaces. Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH v2 0/5] ipvs: fix backup sync daemon with IPv6, and minor updates

t;mcfg.sync_maxlen); <--- 2 TABs ---> But it should be: pr_info("sync thread started: state = MASTER, mcast_ifn = %s, " "syncid = %d, id = %d, maxlen = %d\n", ipvs->mcfg.mcast_ifn, ipvs->mcfg.syncid, tinfo->id, ipvs->mcfg.sync_maxlen); < 1 TAB> Also, the new pr_info calls exceed 80 columns. May be you can reduce the many spaces. Regards -- Julian Anastasov

Re: [PATCH v2 0/5] ipvs: fix backup sync daemon with IPv6, and minor updates

nings from checkpatch that can be fixed, you can check them in this way: scripts/checkpatch.pl --strict /tmp/file.patch Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH v2 0/5] ipvs: fix backup sync daemon with IPv6, and minor updates

nings from checkpatch that can be fixed, you can check them in this way: scripts/checkpatch.pl --strict /tmp/file.patch Regards -- Julian Anastasov

Re: [PATCH ipvs-next] ipvs: count pre-established TCP states as active

nted as "inactive", i.e. cheap ones. The become > "active" quickly but at that time, all of them are already assigned to one > real server (or few), resulting in highly unbalanced distribution. > > Address this by counting the "pre-established" states as &q

Re: [PATCH ipvs-next] ipvs: count pre-established TCP states as active

nted as "inactive", i.e. cheap ones. The become > "active" quickly but at that time, all of them are already assigned to one > real server (or few), resulting in highly unbalanced distribution. > > Address this by counting the "pre-established" states as

Re: [PATCH ipvs-next] ipvs: count pre-established TCP states as active

atomic_inc(>inactconns); > cp->flags |= IP_VS_CONN_F_INACTIVE; > } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) && > - (new_state == IP_VS_TCP_S_ESTABLISHED)) { > +tcp_state_active(new_state)) { > atomic_inc(>activeconns); > atomic_dec(>inactconns); > cp->flags &= ~IP_VS_CONN_F_INACTIVE; > -- > 2.8.3 Regards -- Julian Anastasov <j...@ssi.bg>

Re: [PATCH ipvs-next] ipvs: count pre-established TCP states as active

atomic_inc(>inactconns); > cp->flags |= IP_VS_CONN_F_INACTIVE; > } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) && > - (new_state == IP_VS_TCP_S_ESTABLISHED)) { > +tcp_state_active(new_state)) { > atomic_inc(>activeconns); > atomic_dec(>inactconns); > cp->flags &= ~IP_VS_CONN_F_INACTIVE; > -- > 2.8.3 Regards -- Julian Anastasov

Re: [PATCH 2/2] netfilter: ipvs/SIP: handle ip_vs_fill_iph_skb_off failure

gt; Fixes: b0e010c527de ("ipvs: replace ip_vs_fill_ip4hdr with > ip_vs_fill_iph_skb_off") Looks ok to me, Acked-by: Julian Anastasov but see below... > --- > net/netfilter/ipvs/ip_vs_pe_sip.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > >

Re: [PATCH 1/2] netfilter: ipvs: avoid unused variable warnings

p it and use this one instead when net-next opens: Acked-by: Julian Anastasov > --- > net/netfilter/ipvs/ip_vs_app.c | 8 ++-- > net/netfilter/ipvs/ip_vs_ctl.c | 15 ++- > 2 files changed, 8 insertions(+), 15 deletions(-) > > diff --git a/net/netfilter/ipv

Re: [PATCH 1/2] netfilter: ipvs: avoid unused variable warnings

Simon should drop it and use this one instead when net-next opens: Acked-by: Julian Anastasov <j...@ssi.bg> > --- > net/netfilter/ipvs/ip_vs_app.c | 8 ++-- > net/netfilter/ipvs/ip_vs_ctl.c | 15 ++- > 2 files changed, 8 insertions(+), 15 deletions(-) > &g

Re: [PATCH 2/2] netfilter: ipvs/SIP: handle ip_vs_fill_iph_skb_off failure

<a...@arndb.de> > Fixes: b0e010c527de ("ipvs: replace ip_vs_fill_ip4hdr with > ip_vs_fill_iph_skb_off") Looks ok to me, Acked-by: Julian Anastasov <j...@ssi.bg> but see below... > --- > net/netfilter/ipvs/ip_vs_pe_sip.c | 4 ++-- > 1 file changed, 2

Re: ipv4: ip unreachable with SO_BINDTODEVICE socket

if we should worry for the unicast traffic. If we want frequent updates only for loopback then the check could be: if (rt_cache_valid(rth) && (!(flags & RTCF_LOCAL) || rth->rt_iif == orig_oif)) { Or the following, it should better cache mcast because mcast does not use/need

Re: ipv4: ip unreachable with SO_BINDTODEVICE socket

if we should worry for the unicast traffic. If we want frequent updates only for loopback then the check could be: if (rt_cache_valid(rth) && (!(flags & RTCF_LOCAL) || rth->rt_iif == orig_oif)) { Or the following, it should better cache mcast because mcast does not use/n

Re: [PATCH 4.1 125/159] net: call rcu_read_lock early in process_backlog

two. So now I'm a little unsure about my initial conclusions. > > > > On 29. sep. 2015 09:40, Julian Anastasov wrote: > >> On Tue, 29 Sep 2015, Andre Tomt (LKML) wrote: > > >>They are 2 related patches, the first one is > >> [PATCH 4.1 124/159] net:

  1   2   3   >