ipam: Fix concurrent map access to multipool map#44150
Merged
christarazi merged 1 commit intocilium:mainfrom Feb 23, 2026
Merged
ipam: Fix concurrent map access to multipool map#44150christarazi merged 1 commit intocilium:mainfrom
christarazi merged 1 commit intocilium:mainfrom
Conversation
ef8b5a5 to
fc26224
Compare
Member
Author
|
/test |
fc26224 to
b7da4d3
Compare
Member
Author
|
/test |
pippolo84
reviewed
Feb 4, 2026
Member
pippolo84
left a comment
There was a problem hiding this comment.
Fix LGTM. ✔️
However, after #44030, the multipool manager has been separated from the pod IPAM allocator to reuse the manager core logic for Cilium Network Driver IPAM (see #44081 and #44124).
Also, given that the mutex should be an internal detail of the manager, I propose to move the capacity calculation in the manager like this:
diff --git a/pkg/ipam/multipool.go b/pkg/ipam/multipool.go
index 4328a97bdd..069beeb33e 100644
--- a/pkg/ipam/multipool.go
+++ b/pkg/ipam/multipool.go
@@ -116,24 +116,7 @@ func (c *multiPoolAllocator) Dump() (map[Pool]map[string]string, string) {
}
func (c *multiPoolAllocator) Capacity() uint64 {
- c.manager.mutex.Lock()
- defer c.manager.mutex.Unlock()
-
- var capacity uint64
- for _, pool := range c.manager.pools {
- var p *cidrPool
- switch c.family {
- case IPv4:
- p = pool.v4
- case IPv6:
- p = pool.v6
- }
- if p == nil {
- continue
- }
- capacity += uint64(p.capacity())
- }
- return uint64(capacity)
+ return c.manager.capacity(c.family)
}
func (c *multiPoolAllocator) RestoreFinished() {
diff --git a/pkg/ipam/multipool_manager.go b/pkg/ipam/multipool_manager.go
index 779a647c5b..ea635e2d35 100644
--- a/pkg/ipam/multipool_manager.go
+++ b/pkg/ipam/multipool_manager.go
@@ -762,3 +762,24 @@ func (m *multiPoolManager) releaseIP(ip net.IP, poolName Pool, family Family, up
}
return nil
}
+
+func (m *multiPoolManager) capacity(family Family) uint64 {
+ m.mutex.Lock()
+ defer m.mutex.Unlock()
+
+ var cap uint64
+ for _, pool := range m.pools {
+ var p *cidrPool
+ switch family {
+ case IPv4:
+ p = pool.v4
+ case IPv6:
+ p = pool.v6
+ }
+ if p == nil {
+ continue
+ }
+ cap += uint64(p.capacity())
+ }
+ return uint64(cap)
+}
This should allow to export multiPoolManager.capacity if needed for the Network driver too. WDYT?
b7da4d3 to
1958e36
Compare
For some reason, I forgot to acquire the mutex when accessing the multipool map in 788d1aa ("ipam, metrics: Add new capacity metric"). Fix it now to prevent the concurrent map access panic as seen in cilium#44107. Fixes: 788d1aa ("ipam, metrics: Add new capacity metric") Fixes: cilium#44107 Co-authored-by: Fabio Falzoi <fabio.falzoi@isovalent.com> Signed-off-by: Chris Tarazi <chris@isovalent.com>
1958e36 to
b7b5143
Compare
Member
Author
|
/test Edit: #44434 |
Member
Author
|
Thanks @pippolo84, fixed! |
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For some reason, I forgot to acquire the mutex when accessing the
multipool map in 788d1aa ("ipam, metrics: Add new capacity
metric"). Fix it now to prevent the concurrent map access panic as seen
in #44107.
Fixes: 788d1aa ("ipam, metrics: Add new capacity
metric")
Fixes: #44107
Signed-off-by: Chris Tarazi chris@isovalent.com