Only call UnrefVNID if the pod's netns is still valid
In the event teardown is called multiple times for the same pod, the
additional invocations result in the ref count becoming incorrect,
possibly messing up networking to/from a namespace.
@@ -521,10 +521,11 @@ func (m *podManager) teardown(req *cniserver.PodRequest) error {
} else if err != nil {
return err
}
- }
+
if vnid, err := m.policy.GetVNID(req.PodNamespace); err == nil {
m.policy.UnrefVNID(vnid)
}
+ }
if err := m.ipamDel(req.ContainerId); err != nil {
return err
