From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F5213911CD for ; Mon, 10 Aug 2026 22:14:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786400079; cv=none; b=od7Kc0H7fMEXHKxEklLtKwIrYU12zMSJWVkyC4n+Viu7TLj5rcFi6ATSS60gzFSc5OFkGv9kb5OTUFV7FSzmLtUyqT/60/jcwSu1R1Bv5YxSVZPtaCqfTDOonRsGDSCtTg/1MfC9wxxqnEY+tQbvK4Zn5owneLWslqCwtWezYHg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786400079; c=relaxed/simple; bh=R+nJgBHLUg5G8FqOw6sYG/0O0FQzt2QBmneJAqQJ1SA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iWVzYiYojdR+WF9K7xf8AO7ZgIp3rZYGYtvcURCRbZ88037uaxIcUgjFxxsMC2siWg/FvGMkxPjKJQRbOx1gIvJSbE/tR12KGzWC6yVsE8YMI8OlKG/94cxEuZxoH5FPgiBMWAOwpQMYjkD2PGbZ0/iVllJhyOqqoClFt2F+1ic= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com; spf=pass smtp.mailfrom=openai.com; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b=HcZnci5k; arc=none smtp.client-ip=209.85.215.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openai.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b="HcZnci5k" Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-c9fe3c9bd5fso291543a12.0 for ; Mon, 10 Aug 2026 15:14:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openai.com; s=google; t=1786400077; x=1787004877; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=TcWTILMa3E47IXaacxZ6F1frXvBazt7YqfOX/WCkxYQ=; b=HcZnci5k54jVcI7Y8ArEsKajaXDBUk93zcEtlhBs+8FhaBXUrCABsVoagpo7aQX+n+ b4IpPT34pcagRYWTlZJTl+yfOG/FiONi5JT0kRNEUqouM2MhXk1XFN9jpDTBpSNqdVmG V6oEcO72UWWORBHz6vDvmoA5Dc+XuiLQeQmGI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786400077; x=1787004877; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TcWTILMa3E47IXaacxZ6F1frXvBazt7YqfOX/WCkxYQ=; b=ZPeIpxHtQtpiKgQ4gNKQtSYOlME/dPPXWhLIqBhXftmmg1Rsc2LpZ9g7Pstu4GJ8s9 r1bxwjxYJGGESEQjPDvcNAOijpFGXR86gggV5HOMJ94EY8MQBEuvsx0pFBEV+kqCGg/1 hGARO6tP46I2KOdFfQj3QaTbRBj50mgUFhMy2GwavGd7RkdsAMafQ8HSExrQoa+QwCsd i02hXK14shX9CTG8ZSbcXGC25j6dIw9gRSKX3gMW7dq4Q8GLctVxvgA4gAa/ZP4Ra0VO QuxRhKvgQ9gJIPpQLm5VJXLaUFqg4EpqMX87xHkCD1ckDhiAev3cZBfQP3mrst34xeln QV5Q== X-Forwarded-Encrypted: i=1; AHgh+Rq2eUE8KF5f3E1TrUAYIbVT/nq+aaQh3mc+2gS4SVHKbT+rLGp1sOVNcLqWsWXFtzFgDAogS2fGXYWS6Ms=@vger.kernel.org X-Gm-Message-State: AOJu0YwPi1Fr8Q2o0DXQy7WSwAJjswAmbkJtFXw1h14iKAu9CrgEIiBh rDo2bVFc9jY2jOqbewnh0dEZpkAWp1cHlMzg1r7UmsKAqobKAgedwFxnQT5j+hQNjzs= X-Gm-Gg: AR+sD10jE+P+CYdpWvhUJU4A6ozJLi00rj5J+9UsJ0J+734bkNNqu8jzbAe8yY6INnN IH2lqKOp6YthsnxI5rVzqsh+75afnMe/Pv9F3Pzz8kVqM5FZ6e2XMx2XEU3jhk3tYrGxkUNAmAl 73jFdtEFrKcKWv5wUC2K2E+B6BXiQNg4oXpDuVUwpqawKn0PdkejTvnr0s9618EbmbZfLEGMoua YlTWN0MlGTyATN0ZnqxFy/HFpw3EQXssBlLPQeNCO/1Ud07GzvnE6/bnpqx2sqnJCECO+lFBKTe aHKcjKnTt12PD2Fl0WGIPzTfPC18EJguhlfwpBuxsBpigEca8rFVkpyjks85DDMrTh/Qa4Xn467 ACH06NVcXaluRQXVcmWGJ7agMdXB3U7bLpiBY+pHb1yUIDPkOP+92cKOxo3F9zN6/E3P3czpTD4 aKB468qKJ4+knw+ZlhnB5ZwF1ftbzznBSdPtmCj7k84xRyCiq33J/i9JL83G2oHDxTlniEVmVGR svNPMwrzFbG2vg82rHwwFzWerBlV1eqJxRyJkkc+N/rpDpTnPzFX47wCytta3tY X-Received: by 2002:a05:6a21:7317:b0:3bf:a7d5:df34 with SMTP id adf61e73a8af0-3cc22addd19mr2082694637.0.1786400077512; Mon, 10 Aug 2026 15:14:37 -0700 (PDT) Received: from com-75606.corp.openai.org ([199.47.143.7]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141019b41d9sm37709398c88.5.2026.08.10.15.14.36 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 10 Aug 2026 15:14:37 -0700 (PDT) From: Kyle Zeng To: netdev@vger.kernel.org Cc: Simon Horman , Julian Anastasov , Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , linux-kernel@vger.kernel.org, Kyle Zeng Subject: [PATCH] ipvs: fix reversed sequence option serialization Date: Mon, 10 Aug 2026 15:13:47 -0700 Message-ID: <20260810221347.34267-1-kylebot@openai.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit hton_seq() expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks. This leaves 24 bytes of the kmalloc-backed message unwritten. It may disclose stale heap data and replace the live connection sequence state with values read from the buffer. Pass the connection sequence state as the source and the message payload as the destination for both blocks. Fixes: 986a07579533 ("IPVS: Backup, Change sending to Version 1 format") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Kyle Zeng --- net/netfilter/ipvs/ip_vs_sync.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c index 93038abbf..f6ea6c953 100644 --- a/net/netfilter/ipvs/ip_vs_sync.c +++ b/net/netfilter/ipvs/ip_vs_sync.c @@ -747,9 +747,9 @@ sloop: if (cp->flags & IP_VS_CONN_F_SEQ_MASK) { *(p++) = IPVS_OPT_SEQ_DATA; *(p++) = sizeof(struct ip_vs_sync_conn_options); - hton_seq((struct ip_vs_seq *)p, &cp->in_seq); + hton_seq(&cp->in_seq, (struct ip_vs_seq *)p); p += sizeof(struct ip_vs_seq); - hton_seq((struct ip_vs_seq *)p, &cp->out_seq); + hton_seq(&cp->out_seq, (struct ip_vs_seq *)p); p += sizeof(struct ip_vs_seq); } /* Handle pe data */ -- 2.53.0