Re: [PATCH 4/5 nf-next v3] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Fernando,

linux$ git grep nf_ct_seqadj_init
net/netfilter/nf_conntrack_seqadj.c:int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
net/netfilter/nf_conntrack_seqadj.c:EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);
net/netfilter/nf_synproxy_core.c:                       nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
net/netfilter/nf_synproxy_core.c:               nf_ct_seqadj_init(ct, ctinfo, 0);
net/netfilter/nf_synproxy_core.c:               nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
net/netfilter/nf_synproxy_core.c:                       nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
net/netfilter/nf_synproxy_core.c:               nf_ct_seqadj_init(ct, ctinfo, 0);
net/netfilter/nf_synproxy_core.c:               nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));

On Tue, May 26, 2026 at 04:18:37PM +0200, Fernando Fernandez Mancera wrote:
> diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
> index 5413133a42fa..3e02e252eecc 100644
> --- a/net/netfilter/nf_synproxy_core.c
> +++ b/net/netfilter/nf_synproxy_core.c
> @@ -669,8 +669,10 @@ ipv4_synproxy_hook(void *priv, struct sk_buff *skb,
>  	switch (state->state) {
>  	case TCP_CONNTRACK_CLOSE:
>  		if (th->rst && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
> +			spin_lock_bh(&ct->lock);
>  			nf_ct_seqadj_init(ct, ctinfo, synproxy->isn -
>  						      ntohl(th->seq) + 1);
> +			spin_unlock_bh(&ct->lock);
>  			break;

Maybe add the spin_lock to nf_ct_seqadj_init() given synproxy is the
only user of this function?

>  		}
>