ip_vs_dest_trash_expire() accesses the per-network-namespace IPVS state
and rearms the destination trash timer while entries remain.  The
cleanup path uses timer_delete_sync(), which waits for a running callback
but still allows a racing callback to rearm the timer.

Use timer_shutdown_sync() when the per-network-namespace destination
trash is finally cleaned up.  This prevents the callback from being
queued again before the IPVS state is released.

Fixes: f2431e6e9255 ("IPVS: netns, trash handling")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 4c1c73944..0eb6cdb5f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1192,7 +1192,7 @@ static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
 {
 	struct ip_vs_dest *dest, *nxt;
 
-	timer_delete_sync(&ipvs->dest_trash_timer);
+	timer_shutdown_sync(&ipvs->dest_trash_timer);
 	/* No need to use dest_trash_lock */
 	list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
 		list_del(&dest->t_list);
-- 
2.34.1

	Hello,

On Fri, 4 Sep 2026, Runyu Xiao wrote:

> ip_vs_dest_trash_expire() accesses the per-network-namespace IPVS state
> and rearms the destination trash timer while entries remain.  The
> cleanup path uses timer_delete_sync(), which waits for a running callback
> but still allows a racing callback to rearm the timer.

	timer_delete_sync() can safely stop timer if it
is rearmed by its callback: __timer_delete_sync() waits
the callback to finish (the callback can rearm it) and
then detach it if pending. There must be another call flow
that can rearm it later, otherwise this patch is not needed.

	During cleanup, we do not start the timer from
ip_vs_trash_put_dest(). May be I'm missing something?

> Use timer_shutdown_sync() when the per-network-namespace destination
> trash is finally cleaned up.  This prevents the callback from being
> queued again before the IPVS state is released.
> 
> Fixes: f2431e6e9255 ("IPVS: netns, trash handling")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 4c1c73944..0eb6cdb5f 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1192,7 +1192,7 @@ static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
>  {
>  	struct ip_vs_dest *dest, *nxt;
>  
> -	timer_delete_sync(&ipvs->dest_trash_timer);
> +	timer_shutdown_sync(&ipvs->dest_trash_timer);
>  	/* No need to use dest_trash_lock */
>  	list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
>  		list_del(&dest->t_list);
> -- 
> 2.34.1

Regards

--
Julian Anastasov <ja@ssi.bg>

Hi Julian,

Thanks for reviewing this.

On Fri, 4 Sep 2026, Julian Anastasov wrote:
> timer_delete_sync() can safely stop timer if it
> is rearmed by its callback: __timer_delete_sync() waits
> the callback to finish (the callback can rearm it) and
> then detach it if pending. There must be another call flow
> that can rearm it later, otherwise this patch is not needed.
>
> During cleanup, we do not start the timer from
> ip_vs_trash_put_dest(). May be I'm missing something?

You are right. I missed that the netns cleanup path passes cleanup=true
through ip_vs_flush() and __ip_vs_del_dest() to ip_vs_trash_put_dest().
The !cleanup guard therefore prevents that path from rearming
dest_trash_timer. If the timer callback is already running,
timer_delete_sync() waits for it to finish and removes any timer that the
callback rearmed before returning.

There is therefore no reachable post-cleanup rearm in this path, and the
proposed timer_shutdown_sync() change is unnecessary. Please consider the
v1 patch withdrawn; I will not send a v2.

Sorry for the noise, and thanks for pointing this out.

Regards,
Runyu