[PATCH net] ipvs: shut down destination trash timer on netns cleanup

[PATCH net] ipvs: shut down destination trash timer on netns cleanup

[Runyu Xiao]

ip_vs_dest_trash_expire() accesses the per-network-namespace IPVS state
and rearms the destination trash timer while entries remain.  The
cleanup path uses timer_delete_sync(), which waits for a running callback
but still allows a racing callback to rearm the timer.

Use timer_shutdown_sync() when the per-network-namespace destination
trash is finally cleaned up.  This prevents the callback from being
queued again before the IPVS state is released.

Fixes: f2431e6e9255 ("IPVS: netns, trash handling")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 4c1c73944..0eb6cdb5f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1192,7 +1192,7 @@ static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
 {
 	struct ip_vs_dest *dest, *nxt;
 
-	timer_delete_sync(&ipvs->dest_trash_timer);
+	timer_shutdown_sync(&ipvs->dest_trash_timer);
 	/* No need to use dest_trash_lock */
 	list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
 		list_del(&dest->t_list);
-- 
2.34.1

Re: [PATCH net] ipvs: shut down destination trash timer on netns cleanup

[Julian Anastasov]

	Hello,

On Fri, 4 Sep 2026, Runyu Xiao wrote:

> ip_vs_dest_trash_expire() accesses the per-network-namespace IPVS state
> and rearms the destination trash timer while entries remain.  The
> cleanup path uses timer_delete_sync(), which waits for a running callback
> but still allows a racing callback to rearm the timer.

	timer_delete_sync() can safely stop timer if it
is rearmed by its callback: __timer_delete_sync() waits
the callback to finish (the callback can rearm it) and
then detach it if pending. There must be another call flow
that can rearm it later, otherwise this patch is not needed.

	During cleanup, we do not start the timer from
ip_vs_trash_put_dest(). May be I'm missing something?

> Use timer_shutdown_sync() when the per-network-namespace destination
> trash is finally cleaned up.  This prevents the callback from being
> queued again before the IPVS state is released.
> 
> Fixes: f2431e6e9255 ("IPVS: netns, trash handling")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 4c1c73944..0eb6cdb5f 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1192,7 +1192,7 @@ static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
>  {
>  	struct ip_vs_dest *dest, *nxt;
>  
> -	timer_delete_sync(&ipvs->dest_trash_timer);
> +	timer_shutdown_sync(&ipvs->dest_trash_timer);
>  	/* No need to use dest_trash_lock */
>  	list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
>  		list_del(&dest->t_list);
> -- 
> 2.34.1

Regards

--
Julian Anastasov <ja@ssi.bg>