Hello,
On Sun, 27 Sep 2026, Chengfeng Ye wrote:
> IPVS frees its per-net protocol data before control cleanup cancels
> defense work and unregisters the sysctl table. A defense worker can load
> a protocol data pointer, then namespace cleanup can unlink and free that
> object before the worker dereferences pd->pp or pd->next. The worker's
> securetcp_lock does not serialize with protocol cleanup. A concurrent
> defense-mode sysctl write can reach the same timeout update path.
>
> KASAN reported:
>
> BUG: KASAN: slab-use-after-free in ip_vs_protocol_timeout_change
> Workqueue: events_long defense_work_handler
> Call Trace:
> ip_vs_protocol_timeout_change+0x1b4/0x1e0
> update_defense_level+0x63e/0xd80
> defense_work_handler+0x1e/0xc0
> Allocated by task 125:
> ip_vs_protocol_net_init+0xda/0x2f0
> __ip_vs_init+0x16b/0x240
> setup_net+0xfc/0x310
> Freed by task 12:
> ip_vs_protocol_net_cleanup+0x1d6/0x2e0
> __ip_vs_cleanup_batch+0x7d/0x100
> cleanup_net+0x38c/0x770
>
> Run control cleanup before protocol cleanup so that defense work and
> active sysctl handlers have finished before their protocol data is freed.
> Initialize protocols before exposing the control interface, and unwind
> in reverse order, to enforce the same lifetime on initialization failure.
> Protocol initialization and exit do not depend on control state.
>
> Fixes: 9330419d9aa4 ("IPVS: netns, use ip_vs_proto_data as param.")
> Cc: [email protected]
> Signed-off-by: Chengfeng Ye <[email protected]>
Patch looks good to me for the nf tree, thanks!
Acked-by: Julian Anastasov <[email protected]>
If you want to change the order of ip_vs_protocol_init()
and ip_vs_control_init() in ip_vs_init() for consistency, you
have to send another version or a nf-next patch.
> ---
> net/netfilter/ipvs/ip_vs_core.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index fd503f0efb57..8a3c880fdb26 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -2502,12 +2502,12 @@ static int __net_init __ip_vs_init(struct net *net)
> if (ip_vs_estimator_net_init(ipvs) < 0)
> goto estimator_fail;
>
> - if (ip_vs_control_net_init(ipvs) < 0)
> - goto control_fail;
> -
> if (ip_vs_protocol_net_init(ipvs) < 0)
> goto protocol_fail;
>
> + if (ip_vs_control_net_init(ipvs) < 0)
> + goto control_fail;
> +
> if (ip_vs_app_net_init(ipvs) < 0)
> goto app_fail;
>
> @@ -2527,10 +2527,10 @@ static int __net_init __ip_vs_init(struct net *net)
> conn_fail:
> ip_vs_app_net_cleanup(ipvs);
> app_fail:
> - ip_vs_protocol_net_cleanup(ipvs);
> -protocol_fail:
> ip_vs_control_net_cleanup(ipvs);
> control_fail:
> + ip_vs_protocol_net_cleanup(ipvs);
> +protocol_fail:
> ip_vs_estimator_net_cleanup(ipvs);
> estimator_fail:
> net->ipvs = NULL;
> @@ -2547,8 +2547,8 @@ static void __net_exit __ip_vs_cleanup_batch(struct
> list_head *net_list)
> ipvs = net_ipvs(net);
> ip_vs_conn_net_cleanup(ipvs);
> ip_vs_app_net_cleanup(ipvs);
> - ip_vs_protocol_net_cleanup(ipvs);
> ip_vs_control_net_cleanup(ipvs);
> + ip_vs_protocol_net_cleanup(ipvs);
> ip_vs_estimator_net_cleanup(ipvs);
> IP_VS_DBG(2, "ipvs netns %d released\n", ipvs->gen);
> net->ipvs = NULL;
> --
> 2.43.0
Regards
--
Julian Anastasov <[email protected]>
