From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=217.70.190.124 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794532511; b=kD0oOEiMmj96vqf3aMlONpxr+TWFniZ6C86USkJRqkqRODIqhVPEHfOiq8bn3zY7koqH UVMsnt5pN0K58+unOUkmbn2H/n6GB0q7w76yKNXRysUdzA/2vFlS2V2wSsu31MCTARDtn nHkUFM+y7vBIgrvdhI5lGrxMilGK5kvKN4MR7UdQHNIW5f9Vfb16dT7/fE2RxHexcxxPs l1UasAs3Nfy0sowYnrL5wgFkza4SvLkAqWmfPT9b+HGU+1nRPnBCFk/x7i12DmGrdhIKe uFsFJuO+owfEl6qATK3jWtlqn+/Ckm6Kg7HH0tvCiaaq8W2ZpNCLUBbPImgVVJ+WH+Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794532511; h=DMARC-Filter:DKIM-Signature:Received:From:To:Cc:Subject:Date: Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:X-Spam-Status:X-Spam-Checker-Version; bh=n0B+sKvpe2H3MCp7hBtPgz4Tu1xCOpB3YNEStZ8qVTI=; b=QbVB4Dxsp8FvztKtoLnkN4swuEp3fuunqxfWkXlR03lulYTpbazN2ap53DaBuddORYtl bDi3iOEwfHZoZRksFCyrz6TLinCDwwZRn1imohav7Uds94oT3t5GxdE003Bay25sEdtjD iHBTzXJK05rSDrDqtZRhPciQperhWirVmoeoUm1R70S2F047f+8Ib/obxyeTZL1bynVXQ ooi6oVThs58eDxAziZJsX8aVnMbL/3omnbtaxQXhS7yvwpKIdBgVI35Nw4/dZboarcneU AfeWcX6vcos5mPM8tap0M/Ysi5w8nJOYCeDEGpFIRKuPM3Jta1qXg1J2c3PlnbU4qtA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass header.d=netfilter.org header.i=@netfilter.org header.a=rsa-sha256 header.s=2025 header.b=ttJUwU8n; arc=none smtp.remote-ip=217.70.190.124 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A99FE60A261F; Fri, 13 Nov 2026 01:15:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A99FE60A261F Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.a=rsa-sha256 header.s=2025 header.b=ttJUwU8n DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1794532509; bh=n0B+sKvpe2H3MCp7hBtPgz4Tu1xCOpB3YNEStZ8qVTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ttJUwU8nAVLJuUPSJG3/P6Kx/RoAKobdv03gPgvsQ8e+1zEA34dVL8WH/DiDrU1LS finQiYeqVSIP1w0I1io5eKVTF+1zh0NkwNIMUOKHjwzyTFziiJO7hykT6OamfZzWI9 PsTe9oerx/yytFZ87T58Uhah1VBP+VtkbPugvRGsN1g2gfH8OQFz1RWdlP2OcqeK4l 2X4MootRrgsGCaBglIh30W0r7JIFUuEu1fY9G1VzPjokZyMfO5CVEqtcJjQn4ds/pn g7/yvyWc+chouETWp73E8y5XEwhoWapSrXmGb1yRNlqe79uhUaPj7jGni7qo+4V6x7 UXf9k6jV8lRXg== Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id 7EEAD6005C; Fri, 13 Nov 2026 02:15:08 +0100 (CET) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@kernel.org, horms@kernel.org, fw@strlen.de, ja@ssi.bg Subject: [PATCH net 09/15] ipvs: read flags and seqs in master atomically Date: Fri, 13 Nov 2026 02:14:41 +0100 Message-ID: <20261113011447.2357709-10-pablo@netfilter.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261113011447.2357709-1-pablo@netfilter.org> References: <20261113011447.2357709-1-pablo@netfilter.org> X-Mailing-List: netdev@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Julian Anastasov After we fixed the double read of cp->flags in the master with commit 3e3fe49e8678 ("ipvs: fix buffer overflow when sending sync messages") Sashiko reports that we should also read the cp->flags and the seqs atomically. So if the SEQ_MASK is set, re-read the flags and the seqs under cp->lock to provide a snapshot when sending the sync message. Fixes: 3e3fe49e8678 ("ipvs: fix buffer overflow when sending sync messages") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260927220816.268206-1-pablo%40netfilter.org Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso --- net/netfilter/ipvs/ip_vs_sync.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c index ba2fa1f9d08e..f11c59eca553 100644 --- a/net/netfilter/ipvs/ip_vs_sync.c +++ b/net/netfilter/ipvs/ip_vs_sync.c @@ -539,6 +539,7 @@ static int ip_vs_sync_conn_needed(struct netns_ipvs *ipvs, static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts) { + struct ip_vs_sync_conn_options opts; struct ip_vs_sync_mesg_v0 *m; struct ip_vs_sync_conn_v0 *s; struct ip_vs_sync_buff *buff; @@ -557,6 +558,14 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, if (!ip_vs_sync_conn_needed(ipvs, cp, pkts)) return; + if (flags & IP_VS_CONN_F_SEQ_MASK) { + /* Take atomic snapshot of flags and seqs */ + spin_lock_bh(&cp->lock); + flags = cp->flags; + memcpy(&opts, &cp->sync_conn_opt, sizeof(opts)); + spin_unlock_bh(&cp->lock); + } + spin_lock_bh(&ipvs->sync_buff_lock); if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) { spin_unlock_bh(&ipvs->sync_buff_lock); @@ -604,7 +613,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, if (seq_mask) { struct ip_vs_sync_conn_options *opt = (struct ip_vs_sync_conn_options *)&s[1]; - memcpy(opt, &cp->sync_conn_opt, sizeof(*opt)); + memcpy(opt, &opts, sizeof(*opt)); } m->nr_conns++; @@ -630,6 +639,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, */ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts) { + struct ip_vs_sync_conn_options opts; struct ip_vs_sync_mesg *m; union ip_vs_sync_conn *s; struct ip_vs_sync_buff *buff; @@ -651,6 +661,13 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts) if (!ip_vs_sync_conn_needed(ipvs, cp, pkts)) goto control; flags = READ_ONCE(cp->flags); + if (flags & IP_VS_CONN_F_SEQ_MASK) { + /* Take atomic snapshot of flags and seqs */ + spin_lock_bh(&cp->lock); + flags = cp->flags; + memcpy(&opts, &cp->sync_conn_opt, sizeof(opts)); + spin_unlock_bh(&cp->lock); + } /* Sanity checks */ pe_name_len = 0; @@ -752,9 +769,9 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts) if (seq_mask) { *(p++) = IPVS_OPT_SEQ_DATA; *(p++) = sizeof(struct ip_vs_sync_conn_options); - hton_seq(&cp->in_seq, (struct ip_vs_seq *)p); + hton_seq(&opts.in_seq, (struct ip_vs_seq *)p); p += sizeof(struct ip_vs_seq); - hton_seq(&cp->out_seq, (struct ip_vs_seq *)p); + hton_seq(&opts.out_seq, (struct ip_vs_seq *)p); p += sizeof(struct ip_vs_seq); } /* Handle pe data */ -- 2.47.3