Commit 4eaaf19217 for strongswan.org

commit 4eaaf192176994b4fb70a2a80d2cc67e8cf22525
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Jul 13 16:36:39 2026 +0200

    kernel-netlink: Properly clean up pending entry if VIP installation failed

    This could prevent the VIP from getting installed later and actually
    causes those threads to block indefinitely as they wait for the entry to
    either get removed or the VIP marked as installed, which will never
    happen.

    Fixes: c6b401581a75 ("Changed how kernel-netlink handles virtual IP addresses")

diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
index 6742b618d9..6f9973dc53 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
@@ -2450,6 +2450,17 @@ METHOD(kernel_net_t, add_ip, status_t,
 			}
 			this->lock->unlock(this->lock);
 		}
+		this->lock->write_lock(this->lock);
+		entry = this->vips->get_match(this->vips, &lookup,
+									  (void*)addr_map_entry_match);
+		if (entry)
+		{	/* clean up the pending entry we inserted */
+			iface->addrs->remove(iface->addrs, addr, NULL);
+			addr_map_entry_remove(this->vips, addr, iface);
+			addr_entry_destroy(addr);
+			this->condvar->broadcast(this->condvar);
+		}
+		this->lock->unlock(this->lock);
 		DBG1(DBG_KNL, "adding virtual IP %H failed", virtual_ip);
 		return FAILED;
 	}