Re: [PATCH net] ipvs: fix protocol data lifetime during namespace teardown

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Sun, 27 Sep 2026, Chengfeng Ye wrote:

> IPVS frees its per-net protocol data before control cleanup cancels
> defense work and unregisters the sysctl table. A defense worker can load
> a protocol data pointer, then namespace cleanup can unlink and free that
> object before the worker dereferences pd->pp or pd->next. The worker's
> securetcp_lock does not serialize with protocol cleanup. A concurrent
> defense-mode sysctl write can reach the same timeout update path.
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in ip_vs_protocol_timeout_change
>   Workqueue: events_long defense_work_handler
>   Call Trace:
>    ip_vs_protocol_timeout_change+0x1b4/0x1e0
>    update_defense_level+0x63e/0xd80
>    defense_work_handler+0x1e/0xc0
>   Allocated by task 125:
>    ip_vs_protocol_net_init+0xda/0x2f0
>    __ip_vs_init+0x16b/0x240
>    setup_net+0xfc/0x310
>   Freed by task 12:
>    ip_vs_protocol_net_cleanup+0x1d6/0x2e0
>    __ip_vs_cleanup_batch+0x7d/0x100
>    cleanup_net+0x38c/0x770
> 
> Run control cleanup before protocol cleanup so that defense work and
> active sysctl handlers have finished before their protocol data is freed.
> Initialize protocols before exposing the control interface, and unwind
> in reverse order, to enforce the same lifetime on initialization failure.
> Protocol initialization and exit do not depend on control state.
> 
> Fixes: 9330419d9aa4 ("IPVS: netns, use ip_vs_proto_data as param.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>

	Patch looks good to me for the nf tree, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

	If you want to change the order of ip_vs_protocol_init()
and ip_vs_control_init() in ip_vs_init() for consistency, you
have to send another version or a nf-next patch.

> ---
>  net/netfilter/ipvs/ip_vs_core.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index fd503f0efb57..8a3c880fdb26 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -2502,12 +2502,12 @@ static int __net_init __ip_vs_init(struct net *net)
>  	if (ip_vs_estimator_net_init(ipvs) < 0)
>  		goto estimator_fail;
>  
> -	if (ip_vs_control_net_init(ipvs) < 0)
> -		goto control_fail;
> -
>  	if (ip_vs_protocol_net_init(ipvs) < 0)
>  		goto protocol_fail;
>  
> +	if (ip_vs_control_net_init(ipvs) < 0)
> +		goto control_fail;
> +
>  	if (ip_vs_app_net_init(ipvs) < 0)
>  		goto app_fail;
>  
> @@ -2527,10 +2527,10 @@ static int __net_init __ip_vs_init(struct net *net)
>  conn_fail:
>  	ip_vs_app_net_cleanup(ipvs);
>  app_fail:
> -	ip_vs_protocol_net_cleanup(ipvs);
> -protocol_fail:
>  	ip_vs_control_net_cleanup(ipvs);
>  control_fail:
> +	ip_vs_protocol_net_cleanup(ipvs);
> +protocol_fail:
>  	ip_vs_estimator_net_cleanup(ipvs);
>  estimator_fail:
>  	net->ipvs = NULL;
> @@ -2547,8 +2547,8 @@ static void __net_exit __ip_vs_cleanup_batch(struct list_head *net_list)
>  		ipvs = net_ipvs(net);
>  		ip_vs_conn_net_cleanup(ipvs);
>  		ip_vs_app_net_cleanup(ipvs);
> -		ip_vs_protocol_net_cleanup(ipvs);
>  		ip_vs_control_net_cleanup(ipvs);
> +		ip_vs_protocol_net_cleanup(ipvs);
>  		ip_vs_estimator_net_cleanup(ipvs);
>  		IP_VS_DBG(2, "ipvs netns %d released\n", ipvs->gen);
>  		net->ipvs = NULL;
> -- 
> 2.43.0

Regards

--
Julian Anastasov <ja@ssi.bg>