Hello,
On Mon, 10 Aug 2026, Kyle Zeng wrote:
> hton_seq() expects the host-order source first and the unaligned
> network-order destination second. The version 1 sync sender passes these
> arguments in reverse for both sequence blocks. This leaves 24 bytes of the
> kmalloc-backed message unwritten. It may disclose stale heap data and
> replace the live connection sequence state with values read from the
> buffer.
>
> Pass the connection sequence state as the source and the message payload as
> the destination for both blocks.
>
> Fixes: 986a07579533 ("IPVS: Backup, Change sending to Version 1 format")
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Kyle Zeng <[email protected]>
Looks good to me for the nf tree, thanks!
Acked-by: Julian Anastasov <[email protected]>
> ---
> net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index 93038abbf..f6ea6c953 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -747,9 +747,9 @@ sloop:
> if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
> *(p++) = IPVS_OPT_SEQ_DATA;
> *(p++) = sizeof(struct ip_vs_sync_conn_options);
> - hton_seq((struct ip_vs_seq *)p, &cp->in_seq);
> + hton_seq(&cp->in_seq, (struct ip_vs_seq *)p);
> p += sizeof(struct ip_vs_seq);
> - hton_seq((struct ip_vs_seq *)p, &cp->out_seq);
> + hton_seq(&cp->out_seq, (struct ip_vs_seq *)p);
> p += sizeof(struct ip_vs_seq);
> }
> /* Handle pe data */
> --
> 2.53.0
Regards
--
Julian Anastasov <[email protected]>
