@@ -539,22 +539,33 @@ static int ip_vs_sync_conn_needed(struct netns_ipvs *ipvs,
static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
int pkts)
{
+ struct ip_vs_sync_conn_options opts;
struct ip_vs_sync_mesg_v0 *m;
struct ip_vs_sync_conn_v0 *s;
struct ip_vs_sync_buff *buff;
struct ipvs_master_sync_state *ms;
- int id;
+ u32 flags, seq_mask;
unsigned int len;
+ int id;
if (unlikely(cp->af != AF_INET))
return;
+ flags = READ_ONCE(cp->flags);
/* Do not sync ONE PACKET */
- if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
+ if (flags & IP_VS_CONN_F_ONE_PACKET)
return;
if (!ip_vs_sync_conn_needed(ipvs, cp, pkts))
return;
+ if (flags & IP_VS_CONN_F_SEQ_MASK) {
+ /* Take atomic snapshot of flags and seqs */
+ spin_lock_bh(&cp->lock);
+ flags = cp->flags;
+ memcpy(&opts, &cp->sync_conn_opt, sizeof(opts));
+ spin_unlock_bh(&cp->lock);
+ }
+
spin_lock_bh(&ipvs->sync_buff_lock);
if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
spin_unlock_bh(&ipvs->sync_buff_lock);
@@ -564,8 +575,8 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
id = select_master_thread_id(ipvs, cp);
ms = &ipvs->ms[id];
buff = ms->sync_buff;
- len = (cp->flags & IP_VS_CONN_F_SEQ_MASK) ? FULL_CONN_SIZE :
- SIMPLE_CONN_SIZE;
+ seq_mask = flags & IP_VS_CONN_F_SEQ_MASK;
+ len = seq_mask ? FULL_CONN_SIZE : SIMPLE_CONN_SIZE;
if (buff) {
m = (struct ip_vs_sync_mesg_v0 *) buff->mesg;
/* Send buffer if it is for v1 */
@@ -597,12 +608,12 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
s->caddr = cp->caddr.ip;
s->vaddr = cp->vaddr.ip;
s->daddr = cp->daddr.ip;
- s->flags = htons(cp->flags & ~IP_VS_CONN_F_HASHED);
+ s->flags = htons(flags & ~IP_VS_CONN_F_HASHED);
s->state = htons(cp->state);
- if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
+ if (seq_mask) {
struct ip_vs_sync_conn_options *opt =
(struct ip_vs_sync_conn_options *)&s[1];
- memcpy(opt, &cp->sync_conn_opt, sizeof(*opt));
+ memcpy(opt, &opts, sizeof(*opt));
}
m->nr_conns++;
@@ -628,6 +639,7 @@ static void ip_vs_sync_conn_v0(struct netns_ipvs *ipvs, struct ip_vs_conn *cp,
*/
void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
{
+ struct ip_vs_sync_conn_options opts;
struct ip_vs_sync_mesg *m;
union ip_vs_sync_conn *s;
struct ip_vs_sync_buff *buff;
@@ -635,6 +647,7 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
int id;
__u8 *p;
unsigned int len, pe_name_len, pad;
+ u32 flags, seq_mask;
/* Handle old version of the protocol */
if (sysctl_sync_ver(ipvs) == 0) {
@@ -647,6 +660,14 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
sloop:
if (!ip_vs_sync_conn_needed(ipvs, cp, pkts))
goto control;
+ flags = READ_ONCE(cp->flags);
+ if (flags & IP_VS_CONN_F_SEQ_MASK) {
+ /* Take atomic snapshot of flags and seqs */
+ spin_lock_bh(&cp->lock);
+ flags = cp->flags;
+ memcpy(&opts, &cp->sync_conn_opt, sizeof(opts));
+ spin_unlock_bh(&cp->lock);
+ }
/* Sanity checks */
pe_name_len = 0;
@@ -674,7 +695,8 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
#endif
len = sizeof(struct ip_vs_sync_v4);
- if (cp->flags & IP_VS_CONN_F_SEQ_MASK)
+ seq_mask = flags & IP_VS_CONN_F_SEQ_MASK;
+ if (seq_mask)
len += sizeof(struct ip_vs_sync_conn_options) + 2;
if (cp->pe_data_len)
@@ -720,7 +742,7 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
/* Set message type & copy members */
s->v4.type = (cp->af == AF_INET6 ? STYPE_F_INET6 : 0);
s->v4.ver_size = htons(len & SVER_MASK); /* Version 0 */
- s->v4.flags = htonl(cp->flags & ~IP_VS_CONN_F_HASHED);
+ s->v4.flags = htonl(flags & ~IP_VS_CONN_F_HASHED);
s->v4.state = htons(cp->state);
s->v4.protocol = cp->protocol;
s->v4.cport = cp->cport;
@@ -744,12 +766,12 @@ void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts)
s->v4.vaddr = cp->vaddr.ip;
s->v4.daddr = cp->daddr.ip;
}
- if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
+ if (seq_mask) {
*(p++) = IPVS_OPT_SEQ_DATA;
*(p++) = sizeof(struct ip_vs_sync_conn_options);
- hton_seq(&cp->in_seq, (struct ip_vs_seq *)p);
+ hton_seq(&opts.in_seq, (struct ip_vs_seq *)p);
p += sizeof(struct ip_vs_seq);
- hton_seq(&cp->out_seq, (struct ip_vs_seq *)p);
+ hton_seq(&opts.out_seq, (struct ip_vs_seq *)p);
p += sizeof(struct ip_vs_seq);
}
/* Handle pe data */
Sashiko reports for possible heap buffer overflow when generating sync message for the v0 and v1 message formats. We should read the cp->flags only once because another CPU can concurrently set the SEQ_MASK between the two reads. If the SEQ_MASK is set, re-read the flags and the seq mask under cp->lock atomically. Note that IPVS does not set the SEQ_MASK anymore for the ip_vs_ftp.c helper starting from commit 7f1c40757951 ("IPVS: make FTP work with full NAT support") (2.6.36+) but we still accept it from received sync messages in the backup and the mask can be resent if the backup and master roles are active together. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://sashiko.dev/#/patchset/20260903004149.1037028-1-pablo%40netfilter.org Link: https://sashiko.dev/#/patchset/20260909111338.44357-1-ja%40ssi.bg Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260927220816.268206-1-pablo%40netfilter.org Signed-off-by: Julian Anastasov <ja@ssi.bg> --- net/netfilter/ipvs/ip_vs_sync.c | 46 ++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 12 deletions(-)