hton_seq() expects the host-order source first and the unaligned
network-order destination second. The version 1 sync sender passes these
arguments in reverse for both sequence blocks. This leaves 24 bytes of the
kmalloc-backed message unwritten. It may disclose stale heap data and
replace the live connection sequence state with values read from the
buffer.

Pass the connection sequence state as the source and the message payload as
the destination for both blocks.

Fixes: 986a07579533 ("IPVS: Backup, Change sending to Version 1 format")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 93038abbf..f6ea6c953 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -747,9 +747,9 @@ sloop:
 	if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
 		*(p++) = IPVS_OPT_SEQ_DATA;
 		*(p++) = sizeof(struct ip_vs_sync_conn_options);
-		hton_seq((struct ip_vs_seq *)p, &cp->in_seq);
+		hton_seq(&cp->in_seq, (struct ip_vs_seq *)p);
 		p += sizeof(struct ip_vs_seq);
-		hton_seq((struct ip_vs_seq *)p, &cp->out_seq);
+		hton_seq(&cp->out_seq, (struct ip_vs_seq *)p);
 		p += sizeof(struct ip_vs_seq);
 	}
 	/* Handle pe data */
-- 
2.53.0

	Hello,

On Mon, 10 Aug 2026, Kyle Zeng wrote:

> hton_seq() expects the host-order source first and the unaligned
> network-order destination second. The version 1 sync sender passes these
> arguments in reverse for both sequence blocks. This leaves 24 bytes of the
> kmalloc-backed message unwritten. It may disclose stale heap data and
> replace the live connection sequence state with values read from the
> buffer.
> 
> Pass the connection sequence state as the source and the message payload as
> the destination for both blocks.
> 
> Fixes: 986a07579533 ("IPVS: Backup, Change sending to Version 1 format")
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

	Looks good to me for the nf tree, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

> ---
>  net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
> index 93038abbf..f6ea6c953 100644
> --- a/net/netfilter/ipvs/ip_vs_sync.c
> +++ b/net/netfilter/ipvs/ip_vs_sync.c
> @@ -747,9 +747,9 @@ sloop:
>  	if (cp->flags & IP_VS_CONN_F_SEQ_MASK) {
>  		*(p++) = IPVS_OPT_SEQ_DATA;
>  		*(p++) = sizeof(struct ip_vs_sync_conn_options);
> -		hton_seq((struct ip_vs_seq *)p, &cp->in_seq);
> +		hton_seq(&cp->in_seq, (struct ip_vs_seq *)p);
>  		p += sizeof(struct ip_vs_seq);
> -		hton_seq((struct ip_vs_seq *)p, &cp->out_seq);
> +		hton_seq(&cp->out_seq, (struct ip_vs_seq *)p);
>  		p += sizeof(struct ip_vs_seq);
>  	}
>  	/* Handle pe data */
> -- 
> 2.53.0

Regards

--
Julian Anastasov <ja@ssi.bg>