netfilter: nft_synproxy: avoid possible data-race on update operation

Browse source

[ Upstream commit 36a3200575 ]

During nft_synproxy eval we are reading nf_synproxy_info struct which
can be modified on update operation concurrently. As nf_synproxy_info
struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.

Fixes: ee394f96ad ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Fernando Fernandez Mancera 2025-12-17 21:21:59 +01:00 • committed by Greg Kroah-Hartman

parent 16b4508e87

commit dd42e23b6d

1 changed files with 3 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

net/netfilter/nft_synproxy.c

View file