From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8B123B4E87 for ; Mon, 10 Aug 2026 22:10:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786399843; cv=none; b=KD2gkK3GZZN3JI/htSDd6Je6MZ/5WsJYHgL3d8fWzL3y+hWbEw3hlJ8BBAkS4HDoCZMMucbCVIo9mlw7+yfsu06IhsFUw5vZ4Wl/oJjN0tabIHmwNWHs5RS9XVoSMXNKZTfM19QE+R72rvX8wCwoGs16pPJT3m8aQ18CJKPQWO8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786399843; c=relaxed/simple; bh=+vyoAMTlwmEGbof4bMxmgk90RIXqVlKcKeRZlqjp1cw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qBwHbJDFg+8RPm2PbMwvaeCgzlJ8RFF4rIFIZG7eJBdsWRrLPjPSXLqN1QOOD9jMlxrHxF3qSQDuBOhWSqQPoPXNXThzpaXLWNvhBOR+n0sfTbhFLJJLFoAxjolwvr/SgIg8J9OqXWD5sk1pLcuKJ4QFq3Ej19MfDuGD28pzO2k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com; spf=pass smtp.mailfrom=openai.com; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b=OGP8BmVA; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openai.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=openai.com header.i=@openai.com header.b="OGP8BmVA" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-381b831d535so3116785a91.0 for ; Mon, 10 Aug 2026 15:10:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openai.com; s=google; t=1786399841; x=1787004641; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=GMn9iDYzK+mzxIlQbYoX1t508noteCegqfO7arIOGKg=; b=OGP8BmVAJGzyRO8M/zxWo5ohbf41WJXFwU70H7eMQxXovcMWr1hAfF6g8avV+WuB0i MvVDmyLv01NZeRR+S2TFquHl2TehU6PdyT6TzJj4XXXhDMkNGRuXJnEPIwB/+sr7wXVv llPg/ieZPvXIB70zAGs+BGpxPkiMiga1ETSKA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786399841; x=1787004641; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GMn9iDYzK+mzxIlQbYoX1t508noteCegqfO7arIOGKg=; b=FfX97Sn7FmMhiGX7CmNbKsGJVFvXjLE21TSDoml+uXwdnXjlkQkFhxXKruxTpFvq0E KvVc52JtccIK1T5SNE9gCXIOhSmVUtYLt+ujDhPpOVBV/YqGKGkHZ+GNzrvWV8Hv1jK6 nAspuWBhPKgXjOs2Mc8e1rRP78fw+aKYtW9jVBg0xyMrCu7m0jASJKWIoK9/YW9lMCwQ RRCWL3P/eWOoa/cdVWgHIzFb6EVhb6SMwlcAxZ59FJjI4J2WxzqCeq3/zH3837ncnveH QCSJNkHAGaoHdk5WYvCoCILeaaR9e3wEu71DsKBhDDGD+crC1u3OHGhJ6Muey6OIi9Kl V73Q== X-Forwarded-Encrypted: i=1; AHgh+RrmoF0uJSaJGf4ZkUaD5GhasPX76hMeRNUjBM4q7oRE2RvtrzrtoO/DgoMbqrzJpWdTXC8iNe4C5ZHwH30=@vger.kernel.org X-Gm-Message-State: AOJu0YzQFieB5jzztnjDXXqQQyevAnsJ9klaS+fR4p+4YpBS4fziAYZJ 2QpGE3RjyGdpfe5Q1q9OBp0f5Cxsiuw1sGqWyyFxmEHKdeXQweTusoNy9jDM9GY/odA= X-Gm-Gg: AR+sD121xpZ2mWPbVi7X/Cyga1U/52lpuUcJyvAMv/+BKvJ6uQONeo9wNQYyoEecCyl xfZcVMQSOzmcM1qQaXUYmuhZ7vGByeKCUt0INAb3crv0uq2HMYxjUbBZCmyUwON5FR7ALDXWnQk kYR/8Ayt4GG0pLMw+ZrbRcbeoUxL+Hy6n+xozyEemzmk8WPKjyjJL7WBnobO/s+mp0blsGsHSYP W3P5Ab07I0hM3drtHEb3UqNc9LIcEuXiFTvcsQ2ovOYKHfEue1fIaSQ9FGSY6kZPWb0eSLpqvkQ DKVGxSTTjibAAJcbhLKufb9M5IP5pylV3994roycZTOzEa48Y8MhrHdkNoOKdNDmExiGEHTWamh tIKpX9K+GBGdx6pUPrjvznYJKfH/2b/Q4aEN7w9tjIzsOOBPQwqM5XO9EZbiVdGJ5EHQMIO+Elk 9J3gIm5TP2lb+faEirhYw9Jwzz0W1qA63150GNskYnzWBdk6zDDF0il34086k/tHaPmI2Y8E0b9 HVkIx0QiziFFevlyfJPopohp8QcjK9IBDrlxfBDEELfvyd/KZF2LKBn/NttOiu9 X-Received: by 2002:a17:90b:1d47:b0:36d:b424:4f17 with SMTP id 98e67ed59e1d1-39261f724admr30384368a91.1.1786399841085; Mon, 10 Aug 2026 15:10:41 -0700 (PDT) Received: from com-75606.corp.openai.org ([199.47.143.7]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14101b7b39bsm38509700c88.14.2026.08.10.15.10.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 10 Aug 2026 15:10:40 -0700 (PDT) From: Kyle Zeng To: netdev@vger.kernel.org Cc: Simon Horman , Julian Anastasov , Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , linux-kernel@vger.kernel.org, Kyle Zeng , stable@vger.kernel.org Subject: [PATCH] ipvs: reject invalid states in connection template sync records Date: Mon, 10 Aug 2026 15:10:34 -0700 Message-ID: <20260810221034.33751-1-kylebot@openai.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template state range and still store the value in the connection. A template can be returned by ordinary connection lookup. TCP and SCTP then use the invalid state as an index into their transition tables. Reject invalid template states in both sync protocol versions before looking up or modifying a connection. The version 1 path handles both IPv4 and IPv6 records. Fixes: 275411430f89 ("ipvs: add assured state for conn templates") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Kyle Zeng diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c index 93038ab..6f0c2a4 100644 --- a/net/netfilter/ipvs/ip_vs_sync.c +++ b/net/netfilter/ipvs/ip_vs_sync.c @@ -1002,10 +1002,10 @@ static void ip_vs_process_message_v0(struct netns_ipvs *ipvs, const char *buffer pp->name, state); continue; } - } else { - if (state >= IP_VS_CTPL_S_LAST) - IP_VS_DBG(7, "BACKUP v0, Invalid tpl state %u\n", - state); + } else if (state >= IP_VS_CTPL_S_LAST) { + IP_VS_DBG(7, "BACKUP v0, Invalid tpl state %u\n", + state); + continue; } ip_vs_conn_fill_param(ipvs, AF_INET, s->protocol, @@ -1162,10 +1162,10 @@ static inline int ip_vs_proc_sync_conn(struct netns_ipvs *ipvs, __u8 *p, __u8 *m retc = 40; goto out; } - } else { - if (state >= IP_VS_CTPL_S_LAST) - IP_VS_DBG(7, "BACKUP, Invalid tpl state %u\n", - state); + } else if (state >= IP_VS_CTPL_S_LAST) { + IP_VS_DBG(7, "BACKUP, Invalid tpl state %u\n", state); + retc = 40; + goto out; } if (ip_vs_conn_fill_param_sync(ipvs, af, s, ¶m, pe_data, pe_data_len, pe_name, pe_name_len)) { -- 2.53.0