ipvs: clear the nfct flag under lock

Sashiko warns that cp->flags should be changed under cp->lock

Fixes: 35dfb013149f ("ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1")
Fixes: f0a5e4d7a594 ("ipvs: allow connection reuse for unconfirmed conntrack")
Link: https://sashiko.dev/#/patchset/CALMqdkR704S2BG_QD_bgHTFp2%2B1QCi7n0T4zoZyTo8mDZevYSA%40mail.gmail.com
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 7efa209a517b1cc416e37be2ee5e8487f5661c0c..6b79e0c4d9e284ea4ca9a0ed1e3e84d4523a89b6 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -2194,8 +2194,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
                }
 
                if (resched) {
-                       if (!old_ct)
+                       if (!old_ct) {
+                               spin_lock_bh(&cp->lock);
                                cp->flags &= ~IP_VS_CONN_F_NFCT;
+                               spin_unlock_bh(&cp->lock);
+                       }
                        if (!atomic_read(&cp->n_control))
                                ip_vs_conn_expire_now(cp);
                        __ip_vs_conn_put(cp);
@@ -2211,8 +2214,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
                if (sysctl_expire_nodest_conn(ipvs)) {
                        bool old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
 
-                       if (!old_ct)
+                       if (!old_ct) {
+                               spin_lock_bh(&cp->lock);
                                cp->flags &= ~IP_VS_CONN_F_NFCT;
+                               spin_unlock_bh(&cp->lock);
+                       }
 
                        ip_vs_conn_expire_now(cp);
                        __ip_vs_conn_put(cp);