This is a note to let you know that I've just added the patch titled
ipvs: fix racy memcpy in proc_do_sync_threshold
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ipvs-fix-racy-memcpy-in-proc_do_sync_threshold.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5310760af1d4fbea1452bfc77db5f9a680f7ae47 Mon Sep 17 00:00:00 2001
From: Sishuai Gong <sishuai.system@xxxxxxxxx>
Date: Thu, 10 Aug 2023 15:12:42 -0400
Subject: ipvs: fix racy memcpy in proc_do_sync_threshold
From: Sishuai Gong <sishuai.system@xxxxxxxxx>
commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 upstream.
When two threads run proc_do_sync_threshold() in parallel,
data races could happen between the two memcpy():
Thread-1 Thread-2
memcpy(val, valp, sizeof(val));
memcpy(valp, val, sizeof(val));
This race might mess up the (struct ctl_table *) table->data,
so we add a mutex lock to serialize them.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/netdev/B6988E90-0A1E-4B85-BF26-2DAF6D482433@xxxxxxxxx/
Signed-off-by: Sishuai Gong <sishuai.system@xxxxxxxxx>
Acked-by: Simon Horman <horms@xxxxxxxxxx>
Acked-by: Julian Anastasov <ja@xxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1690,6 +1690,7 @@ static int
proc_do_sync_threshold(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
+ struct netns_ipvs *ipvs = table->extra2;
int *valp = table->data;
int val[2];
int rc;
@@ -1699,6 +1700,7 @@ proc_do_sync_threshold(struct ctl_table
.mode = table->mode,
};
+ mutex_lock(&ipvs->sync_mutex);
memcpy(val, valp, sizeof(val));
rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
if (write) {
@@ -1708,6 +1710,7 @@ proc_do_sync_threshold(struct ctl_table
else
memcpy(valp, val, sizeof(val));
}
+ mutex_unlock(&ipvs->sync_mutex);
return rc;
}
@@ -3944,6 +3947,7 @@ static int __net_init ip_vs_control_net_
ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
tbl[idx].data = &ipvs->sysctl_sync_threshold;
+ tbl[idx].extra2 = ipvs;
tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
Patches currently in stable-queue which might be from sishuai.system@xxxxxxxxx are
queue-4.19/ipvs-fix-racy-memcpy-in-proc_do_sync_threshold.patch
