[PATCH nf 1/1] ipvs: avoid stack overflow from recursive connection expiration

[Zihan Xi]

When a controlled IPVS connection expires, its controller may be expired
synchronously if it has no remaining controlled connections. A chain of
controlled connections can then cause recursive calls to
ip_vs_conn_expire() and exhaust the kernel stack during namespace cleanup.

Defer controller expiration to its timer instead of expiring it
synchronously. Set its timeout to zero, expedite its pending timer with
ip_vs_conn_expire_now(), and drop the temporary reference. This preserves
the existing cleanup semantics while limiting cleanup to one controller per
timer callback.

Fixes: f9200a52eedf ("ipvs: avoid expiring many connections from timer")
Cc: sta...@vger.kernel.org
Reported-by: Vega <v...@nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <r...@tr0jan.top>
Signed-off-by: Luxing Yin <r...@tr0jan.top>
Signed-off-by: Zihan Xi <zih...@nebusec.ai>
---
 net/netfilter/ipvs/ip_vs_conn.c | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 6fa3e1dc534c3..023c01707d862 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1330,20 +1330,6 @@ static void ip_vs_conn_del(struct ip_vs_conn *cp)
        }
 }
 
-/* Try to delete connection while holding reference */
-static void ip_vs_conn_del_put(struct ip_vs_conn *cp)
-{
-       if (timer_delete(&cp->timer)) {
-               /* Drop cp->control chain too */
-               if (cp->control)
-                       cp->timeout = 0;
-               __ip_vs_conn_put(cp);
-               ip_vs_conn_expire(&cp->timer);
-       } else {
-               __ip_vs_conn_put(cp);
-       }
-}
-
 static void ip_vs_conn_expire(struct timer_list *t)
 {
        struct ip_vs_conn *cp = timer_container_of(cp, t, timer);
@@ -1372,7 +1358,9 @@ static void ip_vs_conn_expire(struct timer_list *t)
                            (!(ct->flags & IP_VS_CONN_F_TEMPLATE) ||
                             !(ct->state & IP_VS_CTPL_S_ASSURED))) {
                                IP_VS_DBG(4, "drop controlling connection\n");
-                               ip_vs_conn_del_put(ct);
+                               ct->timeout = 0;
+                               ip_vs_conn_expire_now(ct);
+                               __ip_vs_conn_put(ct);
                        } else if (has_ref) {
                                __ip_vs_conn_put(ct);
                        }
-- 
2.43.0