mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 00:35:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

ipvs: clear the nfct flag under lock

Browse Source 
Sashiko warns that cp->flags should be changed under cp->lock

Fixes: 35dfb01314 ("ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1")
Fixes: f0a5e4d7a5 ("ipvs: allow connection reuse for unconfirmed conntrack")
Link: https://sashiko.dev/#/patchset/CALMqdkR704S2BG_QD_bgHTFp2%2B1QCi7n0T4zoZyTo8mDZevYSA%40mail.gmail.com
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Julian Anastasov
2026-07-22 13:25:39 +03:00
committed by Pablo Neira Ayuso
parent 342e24a339
commit da7d894c41
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
net/netfilter/ipvs/ip_vs_core.c
View File

@@ -2194,8 +2194,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
}
if (resched) {
if (!old_ct)
if (!old_ct) {
spin_lock_bh(&cp->lock);
cp->flags &= ~IP_VS_CONN_F_NFCT;
spin_unlock_bh(&cp->lock);
}
if (!atomic_read(&cp->n_control))
ip_vs_conn_expire_now(cp);
__ip_vs_conn_put(cp);
@@ -2211,8 +2214,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
if (sysctl_expire_nodest_conn(ipvs)) {
bool old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
if (!old_ct)
if (!old_ct) {
spin_lock_bh(&cp->lock);
cp->flags &= ~IP_VS_CONN_F_NFCT;
spin_unlock_bh(&cp->lock);
}
ip_vs_conn_expire_now(cp);
__ip_vs_conn_put(cp);