From: Victor Julien <vjulien@oisf.net>
Date: Sat, 21 Jun 2025 19:13:35 +0000 (+0200)
Subject: nfq: suppress coverity thread warning
X-Git-Tag: suricata-8.0.0~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F13519%2Fhead;p=thirdparty%2Fsuricata.git

nfq: suppress coverity thread warning

CID 1593187: (#1 of 1): Data race condition (MISSING_LOCK)
2. missing_lock: Accessing (*p).nfq_v.mark without holding lock Packet_.persistent.tunnel_lock. Elsewhere, NFQPacketVars_.mark is written to with Packet_.persistent.tunnel_lock held 2 out of 5 times (2 of these accesses strongly imply that it is necessary).

No concurrency happening on non-tunnel packet, so no locking needed.
---

diff --git a/src/source-nfq.c b/src/source-nfq.c
index 6498887f59..a85ba60282 100644
--- a/src/source-nfq.c
+++ b/src/source-nfq.c
@@ -1231,6 +1231,7 @@ TmEcode VerdictNFQ(ThreadVars *tv, Packet *p, void *data)
         /* coverity[missing_lock] */
         p->nfq_v.verdicted = true;
 
+        /* coverity[missing_lock] */
         int ret = NFQSetVerdict(p, p->nfq_v.mark, p->nfq_v.mark_modified);
         if (ret != TM_ECODE_OK) {
             return ret;