Re: [PATCH] ipvs: fix reversed sequence option serialization

[Julian Anastasov]

	Hello,

On Mon, 10 Aug 2026, Kyle Zeng wrote:

> hton_seq() expects the host-order source first and the unaligned
> network-order destination second. The version 1 sync sender passes these
> arguments in reverse for both sequence blocks. This leaves 24 bytes of the
> kmalloc-backed message unwritten. It may disclose stale heap data and
> replace the live connection sequence state with values read from the
> buffer.
> 
> Pass the connection sequence state as the source and the message payload as
> the destination for both blocks.
> 
> Fixes: 986a07579533 ("IPVS: Backup, Change sending to Version 1 format")
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>

	Looks good to me for the nf tree, thanks!

Acked-by: Julian Anastasov <ja@xxxxxx>

> ---
>  net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index 93038abbf..f6ea6c953 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -747,9 +747,9 @@ sloop:
>  	if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
>  		*(p++) = IPVS_OPT_SEQ_DATA;
>  		*(p++) = sizeof(struct ip_vs_sync_conn_options);
> -		hton_seq((struct ip_vs_seq *)p, &cp->in_seq);
> +		hton_seq(&cp->in_seq, (struct ip_vs_seq *)p);
>  		p += sizeof(struct ip_vs_seq);
> -		hton_seq((struct ip_vs_seq *)p, &cp->out_seq);
> +		hton_seq(&cp->out_seq, (struct ip_vs_seq *)p);
>  		p += sizeof(struct ip_vs_seq);
>  	}
>  	/* Handle pe data */
> -- 
> 2.53.0

Regards

--
Julian Anastasov <ja@xxxxxx>