2 files changed, 8 insertions, 8 deletions

diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 3759167f91f5..078887c8c586 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -889,6 +889,7 @@ struct netns_ipvs {
         struct delayed_work     defense_work;   /* Work handler */
         int                     drop_rate;
         int                     drop_counter;
+        int                     old_secure_tcp;
         atomic_t                dropentry;
         /* locks in ctl.c */
         spinlock_t              dropentry_lock;  /* drop entry handling */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c8f81dd15c83..3cccc88ef817 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -93,7 +93,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
 static void update_defense_level(struct netns_ipvs *ipvs)
 {
         struct sysinfo i;
-        static int old_secure_tcp = 0;
         int availmem;
         int nomem;
         int to_change = -1;
@@ -174,35 +173,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
         spin_lock(&ipvs->securetcp_lock);
         switch (ipvs->sysctl_secure_tcp) {
         case 0:
-                if (old_secure_tcp >= 2)
+                if (ipvs->old_secure_tcp >= 2)
                         to_change = 0;
                 break;
         case 1:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                         ipvs->sysctl_secure_tcp = 2;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                 }
                 break;
         case 2:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                         ipvs->sysctl_secure_tcp = 1;
                 }
                 break;
         case 3:
-                if (old_secure_tcp < 2)
+                if (ipvs->old_secure_tcp < 2)
                         to_change = 1;
                 break;
         }
-        old_secure_tcp = ipvs->sysctl_secure_tcp;
+        ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(ipvs,
                                               ipvs->sysctl_secure_tcp > 1);