From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: netdev@vger.kernel.org
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>,
David Ahern <dsahern@kernel.org>,
Ido Schimmel <idosch@nvidia.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
Nikolay Aleksandrov <razor@blackwall.org>,
Paul Moore <paul@paul-moore.com>,
Matthieu Baerts <matttbe@kernel.org>,
Mat Martineau <martineau@kernel.org>,
Geliang Tang <geliang@kernel.org>, Julian Anastasov <ja@ssi.bg>,
Allison Henderson <achender@kernel.org>,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Xin Long <lucien.xin@gmail.com>,
"D. Wythe" <alibuda@linux.alibaba.com>,
Dust Li <dust.li@linux.alibaba.com>,
Sidraya Jayagond <sidraya@linux.ibm.com>,
Mahanta Jambigi <mjambigi@linux.ibm.com>,
Tony Lu <tonylu@linux.alibaba.com>,
Wen Gu <guwen@linux.alibaba.com>,
linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org,
coreteam@netfilter.org, bridge@lists.linux.dev,
linux-security-module@vger.kernel.org, mptcp@lists.linux.dev,
lvs-devel@vger.kernel.org, linux-rdma@vger.kernel.org,
rds-devel@oss.oracle.com, linux-sctp@vger.kernel.org,
linux-s390@vger.kernel.org
Subject: [PATCH net-next 13/14] netfilter: conntrack: annotate data-races around timeout and tcp sysctls
Date: Mon, 9 Nov 2026 10:52:12 +0800 [thread overview]
Message-ID: <20261109025425.328445-14-jiayuan.chen@linux.dev> (raw)
In-Reply-To: <20261109025425.328445-1-jiayuan.chen@linux.dev>
The nf_conntrack_*_timeout* knobs, nf_flowtable_tcp_timeout,
nf_flowtable_udp_timeout and nf_conntrack_tcp_{loose,be_liberal,
max_retrans,ignore_invalid_rst} are read in the packet path without any
lock while their sysctl handlers update them with WRITE_ONCE(). Add
READ_ONCE() to the readers.
KCSAN reports it when nf_conntrack_udp_timeout is changed while UDP
traffic goes through conntrack:
BUG: KCSAN: data-race in nf_conntrack_udp_packet / proc_int_u2k_conv_uop
write (marked) to 0xffffffffb0829bc4 of 4 bytes by task 436 on cpu 0:
proc_int_u2k_conv_uop+0x92/0xa0
sysctl_u2k_int_conv_hz+0x21/0x30
proc_int_conv+0xdf/0x130
do_proc_int_conv_jiffies+0x1b/0x30
proc_vec_conv+0x21/0x40
proc_vec+0x21e/0x6f0
proc_dointvec_conv+0x21/0x40
proc_dointvec_jiffies+0x15/0x30
proc_sys_call_handler+0x282/0x3a0
proc_sys_write+0x13/0x20
...
read to 0xffffffffb0829bc4 of 4 bytes by task 439 on cpu 3:
nf_conntrack_udp_packet+0x27b/0x550
nf_conntrack_in+0x767/0xb20
ipv4_conntrack_local+0xb0/0x120
nf_hook_slow+0x7e/0x180
nf_hook+0x1fa/0x4e0
__ip_local_out+0x1ac/0x3f0
ip_send_skb+0x31/0x120
udp_send_skb+0x4bf/0x640
udp_sendmsg+0xdec/0x18a0
...
value changed: 0x00001d4c -> 0x00001e46
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
net/netfilter/nf_conntrack_core.c | 2 +-
net/netfilter/nf_conntrack_proto_gre.c | 4 +--
net/netfilter/nf_conntrack_proto_icmp.c | 2 +-
net/netfilter/nf_conntrack_proto_icmpv6.c | 2 +-
net/netfilter/nf_conntrack_proto_sctp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 37 ++++++++++++-----------
net/netfilter/nf_conntrack_proto_udp.c | 6 ++--
net/netfilter/nf_flow_table_core.c | 4 +--
8 files changed, 31 insertions(+), 28 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 5c7054753722e..8e332e407529e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1959,7 +1959,7 @@ static int generic_packet(struct nf_conn *ct, struct sk_buff *skb,
if (!timeout)
timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 616ab1e2fc5ed..d8bca1e29797b 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -279,8 +279,8 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,
/* initialize to sane value. Ideally a conntrack helper
* (e.g. in case of pptp) is increasing them */
- ct->proto.gre.stream_timeout = timeouts[GRE_CT_REPLIED];
- ct->proto.gre.timeout = timeouts[GRE_CT_UNREPLIED];
+ ct->proto.gre.stream_timeout = READ_ONCE(timeouts[GRE_CT_REPLIED]);
+ ct->proto.gre.timeout = READ_ONCE(timeouts[GRE_CT_UNREPLIED]);
}
status = READ_ONCE(ct->status);
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 330c6d83d670a..0f6ef0443c6fa 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -98,7 +98,7 @@ int nf_conntrack_icmp_packet(struct nf_conn *ct,
if (!timeout)
timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index 803221781de39..e4eebf13950cb 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -118,7 +118,7 @@ int nf_conntrack_icmpv6_packet(struct nf_conn *ct,
/* Do not immediately delete the connection after the first
successful reply to avoid excessive conntrackd traffic
and also to handle correctly ICMP echo reply duplicates. */
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 49ec8478746ad..047bf69113bf9 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -523,7 +523,7 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
if (!timeouts)
timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
- nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(timeouts[new_state]));
return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b859e409f0796..0c61a16fca400 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -505,7 +505,7 @@ nf_tcp_store_invalid(const struct nf_conn *ct,
const struct nf_tcp_net *tn = nf_tcp_pernet(nf_ct_net(ct));
bool be_liberal;
- be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || tn->tcp_be_liberal;
+ be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || READ_ONCE(tn->tcp_be_liberal);
if (be_liberal)
return NFCT_TCP_ACCEPT;
@@ -904,7 +904,7 @@ static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
ct->proto.tcp.seen[0].td_end;
tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
- } else if (tn->tcp_loose == 0) {
+ } else if (READ_ONCE(tn->tcp_loose) == 0) {
/* Don't try to pick up connections. */
return false;
} else {
@@ -979,7 +979,7 @@ void nf_conntrack_tcp_set_closing(struct nf_conn *ct)
timeouts = tn->timeouts;
}
- timeout = timeouts[TCP_CONNTRACK_CLOSE];
+ timeout = READ_ONCE(timeouts[TCP_CONNTRACK_CLOSE]);
WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp);
spin_unlock_bh(&ct->lock);
@@ -1010,6 +1010,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
struct nf_tcp_invalid_log log = {};
unsigned int index, *timeouts;
bool lowered_timeout = false;
+ unsigned int retrans, unack;
enum nf_ct_tcp_action res;
enum ip_conntrack_dir dir;
const struct tcphdr *th;
@@ -1235,7 +1236,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
break;
if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) &&
- !tn->tcp_ignore_invalid_rst) {
+ !READ_ONCE(tn->tcp_ignore_invalid_rst)) {
/* Invalid RST */
spin_unlock_bh(&ct->lock);
nf_ct_l4proto_log_invalid(skb, ct, state, "invalid rst");
@@ -1322,22 +1323,24 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
if (!timeouts)
timeouts = tn->timeouts;
- if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
- timeout = timeouts[TCP_CONNTRACK_RETRANS];
+ timeout = READ_ONCE(timeouts[new_state]);
+ retrans = READ_ONCE(timeouts[TCP_CONNTRACK_RETRANS]);
+ unack = READ_ONCE(timeouts[TCP_CONNTRACK_UNACK]);
+
+ if (ct->proto.tcp.retrans >= READ_ONCE(tn->tcp_max_retrans) &&
+ timeout > retrans)
+ timeout = retrans;
else if (unlikely(index == TCP_RST_SET &&
new_state == TCP_CONNTRACK_ESTABLISHED) &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
else if (ct->proto.tcp.last_win == 0 &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
- timeout = timeouts[TCP_CONNTRACK_RETRANS];
- else
- timeout = timeouts[new_state];
+ timeout > retrans)
+ timeout = retrans;
spin_unlock_bh(&ct->lock);
if (new_state != old_state)
@@ -1366,8 +1369,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
* pickup with loose=1. Avoid large ESTABLISHED timeout.
*/
if (new_state == TCP_CONNTRACK_ESTABLISHED &&
- timeout > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& (old_state == TCP_CONNTRACK_SYN_RECV
|| old_state == TCP_CONNTRACK_ESTABLISHED)
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 9ea4062752238..99eedaa2b1183 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -116,12 +116,12 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
* stream. Set Assured.
*/
if (status & IPS_SEEN_REPLY) {
- unsigned long extra = timeouts[UDP_CT_UNREPLIED];
+ unsigned long extra = READ_ONCE(timeouts[UDP_CT_UNREPLIED]);
bool stream = false;
/* Still active after two seconds? Extend timeout. */
if (time_after(jiffies, ct->proto.udp.stream_ts)) {
- extra = timeouts[UDP_CT_REPLIED];
+ extra = READ_ONCE(timeouts[UDP_CT_REPLIED]);
stream = (status & IPS_ASSURED) == 0;
}
@@ -135,7 +135,7 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_ASSURED, ct);
} else {
- nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(timeouts[UDP_CT_UNREPLIED]));
}
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 0d72dc8ae47a1..fa25a641e9c38 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -322,11 +322,11 @@ unsigned long flow_offload_get_timeout(struct flow_offload *flow)
if (l4num == IPPROTO_TCP) {
struct nf_tcp_net *tn = nf_tcp_pernet(net);
- timeout = tn->offload_timeout;
+ timeout = READ_ONCE(tn->offload_timeout);
} else if (l4num == IPPROTO_UDP) {
struct nf_udp_net *tn = nf_udp_pernet(net);
- timeout = tn->offload_timeout;
+ timeout = READ_ONCE(tn->offload_timeout);
}
return timeout;
--
2.43.0
next prev parent reply other threads:[~2026-11-09 3:00 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-09 2:51 [PATCH net-next 00/14] net: annotate data-races around sysctl knobs Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 01/14] ipv4: annotate data-races around ip_rt_* sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 02/14] inet: frags: annotate data-races around fqdir->timeout and fqdir->max_dist Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 03/14] ipv6: annotate data-races around addrconf sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 04/14] ipv6: annotate data-races around icmpv6 reply sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 05/14] calipso: annotate data-races around cache sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 06/14] sctp: annotate data-races around sctp sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 07/14] mptcp: annotate data-races around pernet sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 08/14] rds: annotate data-races around core rds sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 09/14] netfilter: conntrack: annotate data-races around conntrack sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 10/14] netfilter: bridge: annotate data-races around br_netfilter and nf_log sysctls Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 11/14] ipvs: annotate data-races around lblc_expiration and lblcr_expiration Jiayuan Chen
2026-11-09 2:52 ` [PATCH net-next 12/14] net/smc: annotate data-races around smc sysctls Jiayuan Chen
2026-11-09 2:52 ` Jiayuan Chen [this message]
2026-11-09 2:52 ` [PATCH net-next 14/14] netfilter: cttimeout: annotate data-races around the default timeouts Jiayuan Chen
2026-11-09 3:11 ` [PATCH net-next 00/14] net: annotate data-races around sysctl knobs Jason Xing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261109025425.328445-14-jiayuan.chen@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=achender@kernel.org \
--cc=alibuda@linux.alibaba.com \
--cc=bridge@lists.linux.dev \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=dust.li@linux.alibaba.com \
--cc=edumazet@kernel.org \
--cc=fw@strlen.de \
--cc=geliang@kernel.org \
--cc=guwen@linux.alibaba.com \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=ja@ssi.bg \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=lvs-devel@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=martineau@kernel.org \
--cc=matttbe@kernel.org \
--cc=mjambigi@linux.ibm.com \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=paul@paul-moore.com \
--cc=phil@nwl.cc \
--cc=razor@blackwall.org \
--cc=rds-devel@oss.oracle.com \
--cc=sidraya@linux.ibm.com \
--cc=tonylu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®