Hello,
On Wed, 1 Apr 2026, Weiming Shi wrote:
> When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local
> variable sched is set to NULL. If ip_vs_start_estimator() subsequently
> fails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched)
> with sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL
> check (because svc->scheduler was set by the successful bind) but then
> dereferences the NULL sched parameter at sched->done_service, causing a
> kernel panic at offset 0x30 from NULL.
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
> RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69)
> Call Trace:
> <TASK>
> ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500)
> do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809)
> nf_setsockopt (net/netfilter/nf_sockopt.c:102)
> ip_setsockopt (net/ipv4/ip_sockglue.c:1427)
> raw_setsockopt (net/ipv4/raw.c:850)
> do_sock_setsockopt (net/socket.c:2322)
> __sys_setsockopt (net/socket.c:2339)
> __x64_sys_setsockopt (net/socket.c:2350)
> do_syscall_64 (arch/x86/entry/syscall_64.c:94)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> </TASK>
>
> Fix by simply not clearing the local sched variable after a successful
> bind. ip_vs_unbind_scheduler() already detects whether a scheduler is
> installed via svc->scheduler, and keeping sched non-NULL ensures the
> error path passes the correct pointer to both ip_vs_unbind_scheduler()
> and ip_vs_scheduler_put().
>
> Fixes: 05f00505a89a ("ipvs: fix crash if scheduler is changed")
> Reported-by: Xiang Mei <[email protected]>
> Signed-off-by: Weiming Shi <[email protected]>
Looks good to me, thanks!
Acked-by: Julian Anastasov <[email protected]>
But the problem popups in more recent kernels (6.2, not 4.2),
when the new error path is added after the ip_vs_start_estimator()
call in commit 705dd3444081 ("ipvs: use kthreads for stats estimation").
> ---
> v2: Remove "sched = NULL" instead of recovering it in out_err (Julian)
>
> net/netfilter/ipvs/ip_vs_ctl.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index 35642de2a0fee..2aaf50f52c8e8 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -1452,7 +1452,6 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct
> ip_vs_service_user_kern *u,
> ret = ip_vs_bind_scheduler(svc, sched);
> if (ret)
> goto out_err;
> - sched = NULL;
> }
>
> ret = ip_vs_start_estimator(ipvs, &svc->stats);
> --
> 2.43.0
Regards
--
Julian Anastasov <[email protected]>
