[PATCH net-next 13/14] netfilter: conntrack: annotate data-races around timeout and tcp sysctls
From: Jiayuan Chen
Date: Sun Nov 08 2026 - 22:06:10 EST
The nf_conntrack_*_timeout* knobs, nf_flowtable_tcp_timeout,
nf_flowtable_udp_timeout and nf_conntrack_tcp_{loose,be_liberal,
max_retrans,ignore_invalid_rst} are read in the packet path without any
lock while their sysctl handlers update them with WRITE_ONCE(). Add
READ_ONCE() to the readers.
KCSAN reports it when nf_conntrack_udp_timeout is changed while UDP
traffic goes through conntrack:
BUG: KCSAN: data-race in nf_conntrack_udp_packet / proc_int_u2k_conv_uop
write (marked) to 0xffffffffb0829bc4 of 4 bytes by task 436 on cpu 0:
proc_int_u2k_conv_uop+0x92/0xa0
sysctl_u2k_int_conv_hz+0x21/0x30
proc_int_conv+0xdf/0x130
do_proc_int_conv_jiffies+0x1b/0x30
proc_vec_conv+0x21/0x40
proc_vec+0x21e/0x6f0
proc_dointvec_conv+0x21/0x40
proc_dointvec_jiffies+0x15/0x30
proc_sys_call_handler+0x282/0x3a0
proc_sys_write+0x13/0x20
...
read to 0xffffffffb0829bc4 of 4 bytes by task 439 on cpu 3:
nf_conntrack_udp_packet+0x27b/0x550
nf_conntrack_in+0x767/0xb20
ipv4_conntrack_local+0xb0/0x120
nf_hook_slow+0x7e/0x180
nf_hook+0x1fa/0x4e0
__ip_local_out+0x1ac/0x3f0
ip_send_skb+0x31/0x120
udp_send_skb+0x4bf/0x640
udp_sendmsg+0xdec/0x18a0
...
value changed: 0x00001d4c -> 0x00001e46
Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
---
net/netfilter/nf_conntrack_core.c | 2 +-
net/netfilter/nf_conntrack_proto_gre.c | 4 +--
net/netfilter/nf_conntrack_proto_icmp.c | 2 +-
net/netfilter/nf_conntrack_proto_icmpv6.c | 2 +-
net/netfilter/nf_conntrack_proto_sctp.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 37 ++++++++++++-----------
net/netfilter/nf_conntrack_proto_udp.c | 6 ++--
net/netfilter/nf_flow_table_core.c | 4 +--
8 files changed, 31 insertions(+), 28 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 5c7054753722e..8e332e407529e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1959,7 +1959,7 @@ static int generic_packet(struct nf_conn *ct, struct sk_buff *skb,
if (!timeout)
timeout = &nf_generic_pernet(nf_ct_net(ct))->timeout;
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 616ab1e2fc5ed..d8bca1e29797b 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -279,8 +279,8 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,
/* initialize to sane value. Ideally a conntrack helper
* (e.g. in case of pptp) is increasing them */
- ct->proto.gre.stream_timeout = timeouts[GRE_CT_REPLIED];
- ct->proto.gre.timeout = timeouts[GRE_CT_UNREPLIED];
+ ct->proto.gre.stream_timeout = READ_ONCE(timeouts[GRE_CT_REPLIED]);
+ ct->proto.gre.timeout = READ_ONCE(timeouts[GRE_CT_UNREPLIED]);
}
status = READ_ONCE(ct->status);
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 330c6d83d670a..0f6ef0443c6fa 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -98,7 +98,7 @@ int nf_conntrack_icmp_packet(struct nf_conn *ct,
if (!timeout)
timeout = &nf_icmp_pernet(nf_ct_net(ct))->timeout;
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index 803221781de39..e4eebf13950cb 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -118,7 +118,7 @@ int nf_conntrack_icmpv6_packet(struct nf_conn *ct,
/* Do not immediately delete the connection after the first
successful reply to avoid excessive conntrackd traffic
and also to handle correctly ICMP echo reply duplicates. */
- nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(*timeout));
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 49ec8478746ad..047bf69113bf9 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -523,7 +523,7 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
if (!timeouts)
timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
- nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[new_state]);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(timeouts[new_state]));
return NF_ACCEPT;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b859e409f0796..0c61a16fca400 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -505,7 +505,7 @@ nf_tcp_store_invalid(const struct nf_conn *ct,
const struct nf_tcp_net *tn = nf_tcp_pernet(nf_ct_net(ct));
bool be_liberal;
- be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || tn->tcp_be_liberal;
+ be_liberal = sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL || READ_ONCE(tn->tcp_be_liberal);
if (be_liberal)
return NFCT_TCP_ACCEPT;
@@ -904,7 +904,7 @@ static noinline bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
ct->proto.tcp.seen[0].td_end;
tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
- } else if (tn->tcp_loose == 0) {
+ } else if (READ_ONCE(tn->tcp_loose) == 0) {
/* Don't try to pick up connections. */
return false;
} else {
@@ -979,7 +979,7 @@ void nf_conntrack_tcp_set_closing(struct nf_conn *ct)
timeouts = tn->timeouts;
}
- timeout = timeouts[TCP_CONNTRACK_CLOSE];
+ timeout = READ_ONCE(timeouts[TCP_CONNTRACK_CLOSE]);
WRITE_ONCE(ct->timeout, timeout + nfct_time_stamp);
spin_unlock_bh(&ct->lock);
@@ -1010,6 +1010,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
struct nf_tcp_invalid_log log = {};
unsigned int index, *timeouts;
bool lowered_timeout = false;
+ unsigned int retrans, unack;
enum nf_ct_tcp_action res;
enum ip_conntrack_dir dir;
const struct tcphdr *th;
@@ -1235,7 +1236,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
break;
if (before(seq, ct->proto.tcp.seen[!dir].td_maxack) &&
- !tn->tcp_ignore_invalid_rst) {
+ !READ_ONCE(tn->tcp_ignore_invalid_rst)) {
/* Invalid RST */
spin_unlock_bh(&ct->lock);
nf_ct_l4proto_log_invalid(skb, ct, state, "invalid rst");
@@ -1322,22 +1323,24 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
if (!timeouts)
timeouts = tn->timeouts;
- if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
- timeout = timeouts[TCP_CONNTRACK_RETRANS];
+ timeout = READ_ONCE(timeouts[new_state]);
+ retrans = READ_ONCE(timeouts[TCP_CONNTRACK_RETRANS]);
+ unack = READ_ONCE(timeouts[TCP_CONNTRACK_UNACK]);
+
+ if (ct->proto.tcp.retrans >= READ_ONCE(tn->tcp_max_retrans) &&
+ timeout > retrans)
+ timeout = retrans;
else if (unlikely(index == TCP_RST_SET &&
new_state == TCP_CONNTRACK_ESTABLISHED) &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
else if (ct->proto.tcp.last_win == 0 &&
- timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
- timeout = timeouts[TCP_CONNTRACK_RETRANS];
- else
- timeout = timeouts[new_state];
+ timeout > retrans)
+ timeout = retrans;
spin_unlock_bh(&ct->lock);
if (new_state != old_state)
@@ -1366,8 +1369,8 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
* pickup with loose=1. Avoid large ESTABLISHED timeout.
*/
if (new_state == TCP_CONNTRACK_ESTABLISHED &&
- timeout > timeouts[TCP_CONNTRACK_UNACK])
- timeout = timeouts[TCP_CONNTRACK_UNACK];
+ timeout > unack)
+ timeout = unack;
} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& (old_state == TCP_CONNTRACK_SYN_RECV
|| old_state == TCP_CONNTRACK_ESTABLISHED)
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 9ea4062752238..99eedaa2b1183 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -116,12 +116,12 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
* stream. Set Assured.
*/
if (status & IPS_SEEN_REPLY) {
- unsigned long extra = timeouts[UDP_CT_UNREPLIED];
+ unsigned long extra = READ_ONCE(timeouts[UDP_CT_UNREPLIED]);
bool stream = false;
/* Still active after two seconds? Extend timeout. */
if (time_after(jiffies, ct->proto.udp.stream_ts)) {
- extra = timeouts[UDP_CT_REPLIED];
+ extra = READ_ONCE(timeouts[UDP_CT_REPLIED]);
stream = (status & IPS_ASSURED) == 0;
}
@@ -135,7 +135,7 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_ASSURED, ct);
} else {
- nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);
+ nf_ct_refresh_acct(ct, ctinfo, skb, READ_ONCE(timeouts[UDP_CT_UNREPLIED]));
}
return NF_ACCEPT;
}
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 0d72dc8ae47a1..fa25a641e9c38 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -322,11 +322,11 @@ unsigned long flow_offload_get_timeout(struct flow_offload *flow)
if (l4num == IPPROTO_TCP) {
struct nf_tcp_net *tn = nf_tcp_pernet(net);
- timeout = tn->offload_timeout;
+ timeout = READ_ONCE(tn->offload_timeout);
} else if (l4num == IPPROTO_UDP) {
struct nf_udp_net *tn = nf_udp_pernet(net);
- timeout = tn->offload_timeout;
+ timeout = READ_ONCE(tn->offload_timeout);
}
return timeout;
--
2.43.0