Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2230252/?format=api
{ "id": 2230252, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2230252/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260429141055.85052-8-ja@ssi.bg/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260429141055.85052-8-ja@ssi.bg>", "date": "2026-04-29T14:10:54", "name": "[PATCHv2,nf,7/8] ipvs: Guard access of HK_TYPE_KTHREAD cpumask with RCU", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "90138271b7712793ef7939e670cb398abfc5bb5a", "submitter": { "id": 2825, "url": "http://patchwork.ozlabs.org/api/1.1/people/2825/?format=api", "name": "Julian Anastasov", "email": "ja@ssi.bg" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260429141055.85052-8-ja@ssi.bg/mbox/", "series": [ { "id": 502075, "url": "http://patchwork.ozlabs.org/api/1.1/series/502075/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=502075", "date": "2026-04-29T14:10:47", "name": "IPVS fixes for nf", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502075/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2230252/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2230252/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-12292-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=ssi.bg header.i=@ssi.bg header.a=rsa-sha256\n header.s=ssi header.b=PSvvmYuS;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12292-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=\"PSvvmYuS\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=193.238.174.39", "smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=ssi.bg" ], "Received": [ "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5K892pqBz1yHX\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 30 Apr 2026 00:15:21 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 2784F3012BE2\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 29 Apr 2026 14:14:57 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id E665D3FE679;\n\tWed, 29 Apr 2026 14:14:42 +0000 (UTC)", "from mx.ssi.bg (mx.ssi.bg [193.238.174.39])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id AA7CE3FE64E;\n\tWed, 29 Apr 2026 14:14:40 +0000 (UTC)", "from mx.ssi.bg (localhost [127.0.0.1])\n\tby mx.ssi.bg (Potsfix) with ESMTP id 99B4821CD8;\n\tWed, 29 Apr 2026 17:14:12 +0300 (EEST)", "from box.ssi.bg (box.ssi.bg [193.238.174.46])\n\tby mx.ssi.bg (Potsfix) with ESMTPS;\n\tWed, 29 Apr 2026 17:14:11 +0300 (EEST)", "from ja.ssi.bg (unknown [213.16.62.126])\n\tby box.ssi.bg (Potsfix) with ESMTPSA id B26776088F;\n\tWed, 29 Apr 2026 17:14:10 +0300 (EEST)", "from ja.home.ssi.bg (localhost.localdomain [127.0.0.1])\n\tby ja.ssi.bg (8.18.1/8.18.1) with ESMTP id 63TEBMjq085110;\n\tWed, 29 Apr 2026 17:11:22 +0300", "(from root@localhost)\n\tby ja.home.ssi.bg (8.18.1/8.18.1/Submit) id 63TEBMjv085109;\n\tWed, 29 Apr 2026 17:11:22 +0300" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777472082; cv=none;\n b=onXwYWJM28q0R9fcdFmxdoPSfjSLk6M0imbHzUPbdppXAKHK3tB/3jF1ejoaGvQM8Kx8llguVfMe4INljmCTdSFJifCyu0OIfTelqte+h/7KOzMq1uX6yQBXazOc06QNk7RnfklDotMOoLS/X2TFGNGTLhvMEILlpwJOTBHsmBM=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777472082; c=relaxed/simple;\n\tbh=VTwq0UWthz0QpJzYDrKRtfiupj+O/yP9vV5eAzWzF8g=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=X6WhJezkvigNh4duaGJxDf7/THI7zvQLdUg4VWGb8bS5gKG0eIbzBfBDZHFqZN11f7qXpsaoS+uSOZ/9yzCsEwSZOgmXVQND30VB53FTxryt5IWtquv83nBAvHcu7w0DVn36jo/dKof/ObIwT8ONnZKixn1NkVUFI6cU2cjHKEQ=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg;\n spf=pass smtp.mailfrom=ssi.bg;\n dkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=PSvvmYuS;\n arc=none smtp.client-ip=193.238.174.39", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ssi.bg; h=cc:cc\n\t:content-transfer-encoding:date:from:from:in-reply-to:message-id\n\t:mime-version:references:reply-to:subject:subject:to:to; s=ssi;\n\t bh=eDhsBF6QpJzkCaUZXdy+0cspQLn0pC7/3H/qKuY5fz4=; b=PSvvmYuSvdTr\n\tHNr+cKaP6pvpzzeI0d/kSAXglBtD1sKNCi77sPYC0IMjwHToh15m/0DRwRuJb8Dp\n\tCMfjgx+XcleAqvoGT9U06lLvroikTFQGenS2Al74Zt0RDRS3FzxcZgnx8vjCqW4Z\n\t3dU2sQjvVJ+cO0Vu6KUAqAvS48P+RyDRSj7g6tV10nFDZhcuqgf9wStr9QxRTtp7\n\tMVxN+9+Q1iO97jh02AOlkXtiLqlUYWMeIJsWLprLAQLVq4mG5GCVr7jVfk6RFgGU\n\tdZuO3egiAH6xrmywpJRCQCF55LVZCtIO+zGg4f6fnDXKnpTiF3ycSLsflPMPdgTf\n\tIWTGDuxGPrGNEvMd/gL5KQuc+5SUdawov2AKNSHeEgzOACB+I1y78nO6IY8HwH7e\n\t8vw0GalrElHJzpaH/qJjOemG9zfWSEh8eys2vFONJ2ip4o4+uesTL0Hkq076ikem\n\tpm5kg8gUkoQZWRPe83bycZ4Q3ae6bYM6M3IQ556T7HuJLp2sK/H5Sp7x46SFDdsx\n\tYylqXKy6iH+4CGLuuqFq9Uh9X3Bp01SPYOFZAw1J0iBvbgRHwJfgb1uamEdXba9h\n\tIUu6zvZ50nv+E+AEv5gH1yV0Ii2gdpG81CDzb2Xm2c7mQF+PFirxwymRiyY4E/+6\n\tn6TLvM7d2UQt9VXwGbw7EKGCkayGJPc=", "From": "Julian Anastasov <ja@ssi.bg>", "To": "Simon Horman <horms@verge.net.au>", "Cc": "Pablo Neira Ayuso <pablo@netfilter.org>, Florian Westphal <fw@strlen.de>,\n Waiman Long <longman@redhat.com>, lvs-devel@vger.kernel.org,\n netfilter-devel@vger.kernel.org", "Subject": "[PATCHv2 nf 7/8] ipvs: Guard access of HK_TYPE_KTHREAD cpumask with\n RCU", "Date": "Wed, 29 Apr 2026 17:10:54 +0300", "Message-ID": "<20260429141055.85052-8-ja@ssi.bg>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260429141055.85052-1-ja@ssi.bg>", "References": "<20260429141055.85052-1-ja@ssi.bg>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "From: Waiman Long <longman@redhat.com>\n\nThe ip_vs_ctl.c file and the associated ip_vs.h file are the only places\nin the kernel where HK_TYPE_KTHREAD cpumask is being retrieved and used.\nNow that HK_TYPE_KTHREAD/HK_TYPE_DOMAIN cpumask can be changed at run\ntime. We need to use RCU to guard access to this cpumask to avoid a\npotential UAF problem as the returned cpumask may be freed before it\nis being used.\n\nWe can replace HK_TYPE_KTHREAD by HK_TYPE_DOMAIN as they are aliases\nof each other, but keeping the HK_TYPE_KTHREAD name can highlight the\nfact that it is the kthread initiated by ipvs that is being controlled.\n\nFixes: 03ff73510169 (\"cpuset: Update HK_TYPE_DOMAIN cpumask from cpuset\")\nSigned-off-by: Waiman Long <longman@redhat.com>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\n---\n include/net/ip_vs.h | 20 ++++++++++++++++----\n net/netfilter/ipvs/ip_vs_ctl.c | 13 ++++++++-----\n 2 files changed, 24 insertions(+), 9 deletions(-)", "diff": "diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h\nindex d28ad8a0541f..02762ce73a0c 100644\n--- a/include/net/ip_vs.h\n+++ b/include/net/ip_vs.h\n@@ -1412,7 +1412,7 @@ static inline int sysctl_run_estimation(struct netns_ipvs *ipvs)\n \treturn ipvs->sysctl_run_estimation;\n }\n \n-static inline const struct cpumask *sysctl_est_cpulist(struct netns_ipvs *ipvs)\n+static inline const struct cpumask *__sysctl_est_cpulist(struct netns_ipvs *ipvs)\n {\n \tif (ipvs->est_cpulist_valid)\n \t\treturn ipvs->sysctl_est_cpulist;\n@@ -1530,7 +1530,7 @@ static inline int sysctl_run_estimation(struct netns_ipvs *ipvs)\n \treturn 1;\n }\n \n-static inline const struct cpumask *sysctl_est_cpulist(struct netns_ipvs *ipvs)\n+static inline const struct cpumask *__sysctl_est_cpulist(struct netns_ipvs *ipvs)\n {\n \treturn housekeeping_cpumask(HK_TYPE_KTHREAD);\n }\n@@ -1565,6 +1565,18 @@ static inline int sysctl_svc_lfactor(struct netns_ipvs *ipvs)\n \treturn READ_ONCE(ipvs->sysctl_svc_lfactor);\n }\n \n+static inline bool sysctl_est_cpulist_empty(struct netns_ipvs *ipvs)\n+{\n+\tguard(rcu)();\n+\treturn cpumask_empty(__sysctl_est_cpulist(ipvs));\n+}\n+\n+static inline unsigned int sysctl_est_cpulist_weight(struct netns_ipvs *ipvs)\n+{\n+\tguard(rcu)();\n+\treturn cpumask_weight(__sysctl_est_cpulist(ipvs));\n+}\n+\n /* IPVS core functions\n * (from ip_vs_core.c)\n */\n@@ -1904,7 +1916,7 @@ static inline void ip_vs_est_stopped_recalc(struct netns_ipvs *ipvs)\n \t/* Stop tasks while cpulist is empty or if disabled with flag */\n \tipvs->est_stopped = !sysctl_run_estimation(ipvs) ||\n \t\t\t (ipvs->est_cpulist_valid &&\n-\t\t\t cpumask_empty(sysctl_est_cpulist(ipvs)));\n+\t\t\t sysctl_est_cpulist_empty(ipvs));\n #endif\n }\n \n@@ -1920,7 +1932,7 @@ static inline bool ip_vs_est_stopped(struct netns_ipvs *ipvs)\n static inline int ip_vs_est_max_threads(struct netns_ipvs *ipvs)\n {\n \tunsigned int limit = IPVS_EST_CPU_KTHREADS *\n-\t\t\t cpumask_weight(sysctl_est_cpulist(ipvs));\n+\t\t\t sysctl_est_cpulist_weight(ipvs);\n \n \treturn max(1U, limit);\n }\ndiff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c\nindex 5c9f8e0e238f..c7c7f6a7a9f6 100644\n--- a/net/netfilter/ipvs/ip_vs_ctl.c\n+++ b/net/netfilter/ipvs/ip_vs_ctl.c\n@@ -2394,11 +2394,14 @@ static int ipvs_proc_est_cpumask_get(const struct ctl_table *table,\n \n \tmutex_lock(&ipvs->est_mutex);\n \n-\tif (ipvs->est_cpulist_valid)\n-\t\tmask = *valp;\n-\telse\n-\t\tmask = (struct cpumask *)housekeeping_cpumask(HK_TYPE_KTHREAD);\n-\tret = scnprintf(buffer, size, \"%*pbl\\n\", cpumask_pr_args(mask));\n+\t/* HK_TYPE_KTHREAD cpumask needs RCU protection */\n+\tscoped_guard(rcu) {\n+\t\tif (ipvs->est_cpulist_valid)\n+\t\t\tmask = *valp;\n+\t\telse\n+\t\t\tmask = (struct cpumask *)housekeeping_cpumask(HK_TYPE_KTHREAD);\n+\t\tret = scnprintf(buffer, size, \"%*pbl\\n\", cpumask_pr_args(mask));\n+\t}\n \n \tmutex_unlock(&ipvs->est_mutex);\n \n", "prefixes": [ "PATCHv2", "nf", "7/8" ] }