Re: [PATCH net-next 13/14] netfilter: conntrack: annotate data-races around timeout and tcp sysctls

[Simon Horman]

On Mon, Nov 09, 2026 at 10:52:12AM +0800, Jiayuan Chen wrote:
> The nf_conntrack_*_timeout* knobs, nf_flowtable_tcp_timeout,
> nf_flowtable_udp_timeout and nf_conntrack_tcp_{loose,be_liberal,
> max_retrans,ignore_invalid_rst} are read in the packet path without any
> lock while their sysctl handlers update them with WRITE_ONCE(). Add
> READ_ONCE() to the readers.
> 
> KCSAN reports it when nf_conntrack_udp_timeout is changed while UDP
> traffic goes through conntrack:
> 
>   BUG: KCSAN: data-race in nf_conntrack_udp_packet / proc_int_u2k_conv_uop
> 
>   write (marked) to 0xffffffffb0829bc4 of 4 bytes by task 436 on cpu 0:
>    proc_int_u2k_conv_uop+0x92/0xa0
>    sysctl_u2k_int_conv_hz+0x21/0x30
>    proc_int_conv+0xdf/0x130
>    do_proc_int_conv_jiffies+0x1b/0x30
>    proc_vec_conv+0x21/0x40
>    proc_vec+0x21e/0x6f0
>    proc_dointvec_conv+0x21/0x40
>    proc_dointvec_jiffies+0x15/0x30
>    proc_sys_call_handler+0x282/0x3a0
>    proc_sys_write+0x13/0x20
>    ...
> 
>   read to 0xffffffffb0829bc4 of 4 bytes by task 439 on cpu 3:
>    nf_conntrack_udp_packet+0x27b/0x550
>    nf_conntrack_in+0x767/0xb20
>    ipv4_conntrack_local+0xb0/0x120
>    nf_hook_slow+0x7e/0x180
>    nf_hook+0x1fa/0x4e0
>    __ip_local_out+0x1ac/0x3f0
>    ip_send_skb+0x31/0x120
>    udp_send_skb+0x4bf/0x640
>    udp_sendmsg+0xdec/0x18a0
>    ...
> 
>   value changed: 0x00001d4c -> 0x00001e46
> 
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>