]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nft_synproxy: avoid possible data-race on update operation
authorFernando Fernandez Mancera <fmancera@suse.de>
Wed, 17 Dec 2025 20:21:59 +0000 (21:21 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 19 Jan 2026 12:12:10 +0000 (13:12 +0100)
commit41f59278d628ffc132b2c196530355320b7da952
treef1bb8493e90cb5d851345ec199336ef17c4b8869
parentd5aee5e8881a6a97beeaef1932e925abbb7fcd9a
netfilter: nft_synproxy: avoid possible data-race on update operation

[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]

During nft_synproxy eval we are reading nf_synproxy_info struct which
can be modified on update operation concurrently. As nf_synproxy_info
struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.

Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nft_synproxy.c