linux-kernel - Re: [PATCH net] ipvs: Fix clamp() order in ip_vs_conn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMRc=McCc3G4D4rHVMfGBTdvi6z5Nbxqzg+k8iN11+vazffSnw@mail.gmail.com>
Date: Wed, 11 Dec 2024 14:53:27 +0100
From: Bartosz Golaszewski <brgl@...ev.pl>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Julian Anastasov <ja@....bg>, Simon Horman <horms@...ge.net.au>, 
	Pablo Neira Ayuso <pablo@...filter.org>, Jozsef Kadlecsik <kadlec@...filter.org>, 
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org, 
	lvs-devel@...r.kernel.org, netfilter-devel@...r.kernel.org, 
	coreteam@...filter.org, linux-kernel@...r.kernel.org, 
	David Laight <David.Laight@...lab.com>
Subject: Re: [PATCH net] ipvs: Fix clamp() order in ip_vs_conn_init()

On Wed, Dec 11, 2024 at 2:16 PM Dan Carpenter <dan.carpenter@...aro.org> wrote:
>
> We recently added some build time asserts to detect incorrect calls to
> clamp and it detected this bug which breaks the build.  The variable
> in this clamp is "max_avail" and it should be the first argument.  The
> code currently is the equivalent to max = max(max_avail, max).
>
> Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
> Closes: https://lore.kernel.org/all/CA+G9fYsT34UkGFKxus63H6UVpYi5GRZkezT9MRLfAbM3f6ke0g@mail.gmail.com/
> Fixes: 4f325e26277b ("ipvs: dynamically limit the connection hash table")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
> I've been trying to add stable CC's to my commits but I'm not sure the
> netdev policy on this.  Do you prefer to add them yourself?
>
>  net/netfilter/ipvs/ip_vs_conn.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
> index 98d7dbe3d787..9f75ac801301 100644
> --- a/net/netfilter/ipvs/ip_vs_conn.c
> +++ b/net/netfilter/ipvs/ip_vs_conn.c
> @@ -1495,7 +1495,7 @@ int __init ip_vs_conn_init(void)
>         max_avail -= 2;         /* ~4 in hash row */
>         max_avail -= 1;         /* IPVS up to 1/2 of mem */
>         max_avail -= order_base_2(sizeof(struct ip_vs_conn));
> -       max = clamp(max, min, max_avail);
> +       max = clamp(max_avail, min, max);
>         ip_vs_conn_tab_bits = clamp_val(ip_vs_conn_tab_bits, min, max);
>         ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
>         ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
> --
> 2.45.2
>

Tested-by: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>