From c6200095322cca78f5ae409bfe205a593fc8e02e Mon Sep 17 00:00:00 2001
From: Casey Callendrello <cdc@redhat.com>
Date: Wed, 28 Oct 2020 12:26:31 +0100
Subject: [PATCH] fix pod creation deadlock

Commit b5f89a66 introduced a deadlock on pod creation, but only for
multitenant mode.

The fix is to lock runningPods only when actually accessing it, rather than
broadly.

Fixes: 1890130
---
 pkg/network/node/pod.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkg/network/node/pod.go b/pkg/network/node/pod.go
index 32618498f..d48e8bfba 100644
--- a/pkg/network/node/pod.go
+++ b/pkg/network/node/pod.go
@@ -255,9 +255,6 @@ func (m *podManager) processCNIRequests() {
 }
 
 func (m *podManager) processRequest(request *cniserver.PodRequest) *cniserver.PodResult {
-	m.runningPodsLock.Lock()
-	defer m.runningPodsLock.Unlock()
-
 	pk := getPodKey(request.PodNamespace, request.PodName)
 	result := &cniserver.PodResult{}
 	switch request.Command {
@@ -266,6 +263,8 @@ func (m *podManager) processRequest(request *cniserver.PodRequest) *cniserver.Po
 		if ipamResult != nil {
 			result.Response, err = json.Marshal(ipamResult)
 			if err == nil {
+				m.runningPodsLock.Lock()
+				defer m.runningPodsLock.Unlock()
 				m.runningPods[pk] = runningPod
 				if m.ovs != nil {
 					m.updateLocalMulticastRulesWithLock(runningPod.vnid)
@@ -280,6 +279,8 @@ func (m *podManager) processRequest(request *cniserver.PodRequest) *cniserver.Po
 	case cniserver.CNI_UPDATE:
 		vnid, err := m.podHandler.update(request)
 		if err == nil {
+			m.runningPodsLock.Lock()
+			defer m.runningPodsLock.Unlock()
 			if runningPod, exists := m.runningPods[pk]; exists {
 				runningPod.vnid = vnid
 			}
@@ -288,12 +289,14 @@ func (m *podManager) processRequest(request *cniserver.PodRequest) *cniserver.Po
 		}
 		result.Err = err
 	case cniserver.CNI_DEL:
+		m.runningPodsLock.Lock()
 		if runningPod, exists := m.runningPods[pk]; exists {
 			delete(m.runningPods, pk)
 			if m.ovs != nil {
 				m.updateLocalMulticastRulesWithLock(runningPod.vnid)
 			}
 		}
+		m.runningPodsLock.Unlock()
 		result.Err = m.podHandler.teardown(request)
 		if result.Err != nil {
 			klog.Warningf("CNI_DEL %s failed: %v", pk, result.Err)