]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nft_synproxy: avoid possible data-race on update operation
authorFernando Fernandez Mancera <fmancera@suse.de>
Wed, 17 Dec 2025 20:21:59 +0000 (21:21 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 17 Jan 2026 15:31:22 +0000 (16:31 +0100)
commitdd42e23b6d9e13128682015f1be83f2176709b9f
treed3ca9368ade89bce03455d41f54ad185d01d844e
parent16b4508e871785096a3ae974f4b3069ab3ed80c5
netfilter: nft_synproxy: avoid possible data-race on update operation

[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]

During nft_synproxy eval we are reading nf_synproxy_info struct which
can be modified on update operation concurrently. As nf_synproxy_info
struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.

Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nft_synproxy.c