Re: [PATCH net] ipvs: shut down destination trash timer on netns cleanup
From: Julian Anastasov <ja@ssi.bg>
Date: 2026-09-04 13:51:42
Also in:
lkml, lvs-devel, netfilter-devel, stable
Hello, On Fri, 4 Sep 2026, Runyu Xiao wrote:
ip_vs_dest_trash_expire() accesses the per-network-namespace IPVS state and rearms the destination trash timer while entries remain. The cleanup path uses timer_delete_sync(), which waits for a running callback but still allows a racing callback to rearm the timer.
timer_delete_sync() can safely stop timer if it is rearmed by its callback: __timer_delete_sync() waits the callback to finish (the callback can rearm it) and then detach it if pending. There must be another call flow that can rearm it later, otherwise this patch is not needed. During cleanup, we do not start the timer from ip_vs_trash_put_dest(). May be I'm missing something?
quoted hunk ↗ jump to hunk
Use timer_shutdown_sync() when the per-network-namespace destination trash is finally cleaned up. This prevents the callback from being queued again before the IPVS state is released. Fixes: f2431e6e9255 ("IPVS: netns, trash handling") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao <redacted>diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 4c1c73944..0eb6cdb5f 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c@@ -1192,7 +1192,7 @@ static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs) { struct ip_vs_dest *dest, *nxt; - timer_delete_sync(&ipvs->dest_trash_timer); + timer_shutdown_sync(&ipvs->dest_trash_timer); /* No need to use dest_trash_lock */ list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) { list_del(&dest->t_list);-- 2.34.1
Regards -- Julian Anastasov [off-list ref]