]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nft_synproxy: avoid possible data-race on update operation
authorFernando Fernandez Mancera <fmancera@suse.de>
Wed, 17 Dec 2025 20:21:59 +0000 (21:21 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 19 Jan 2026 12:10:16 +0000 (13:10 +0100)
commitd65b19f34c2adf485409b8134d91fc05fe8c10fd
tree6fb266cb2c546d2b12b2dfa5205c4b59eeb8b526
parentddd097698d8be18cfafd07add428de2eb6a945a7
netfilter: nft_synproxy: avoid possible data-race on update operation

[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]

During nft_synproxy eval we are reading nf_synproxy_info struct which
can be modified on update operation concurrently. As nf_synproxy_info
struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.

Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nft_synproxy.c