AZL-97365

In the Linux kernel, the following vulnerability has been resolved:

ipvs: stop estimator after disabled calc phase

IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs->enable during that phase, ipvsestcalcphase() can return without installing positive limits.

The kthread can then continue into its main loop and drain esttemplist with zero chainmax, tickmax and estmaxcount values. Each enqueue consumes one available tick row, but estcount never reaches the zero estmaxcount value. After all rows are consumed, the row lookup returns IPVSESTNTICKS and ipvsenqueueestimator() writes past the ticks and tick_len arrays.

Exit kthread 0 after the calculation phase if the kthread is stopping or IPVS has been disabled. That keeps temporary estimators from being drained after the limits failed to initialize.

Estimator kthreads can now self-exit before teardown or reload stops kd->task. Keep an extra task reference after creation and release it with kthreadstopput(), so kd->task remains valid until the stop paths consume that reference.