[PATCH] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[PATCH] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Sun Jian]

The nf_nat_amanda_hook pointer is accessed via rcu_dereference(), but
it lacks the __rcu annotation in its declaration and definition. Sparse
reports "incompatible types in comparison expression (different
address spaces)" errors in nf_conntrack_amanda.c.

Fix this by:
1. Adding __rcu and __read_mostly to the global nf_nat_amanda_hook
   declaration.
2. Adding __rcu to the global nf_nat_amanda_hook definition.
3. Explicitly declaring the local nf_nat_amanda function pointer
   without __rcu to store the dereferenced pointer.
4. Using rcu_dereference_raw() to fetch the hook address, which
   satisfies sparse's type checking for function pointers.

Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_amanda.h |  3 ++-
 net/netfilter/nf_conntrack_amanda.c           | 11 ++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 6f0ac896fcc9..edf1d30135a3 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -12,5 +12,6 @@ extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
 					  unsigned int protoff,
 					  unsigned int matchoff,
 					  unsigned int matchlen,
-					  struct nf_conntrack_expect *exp);
+					  struct nf_conntrack_expect *exp)
+					  __rcu __read_mostly;
 #endif /* _NF_CONNTRACK_AMANDA_H */
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 7be4c35e4795..7b3fffea45da 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -43,7 +43,7 @@ unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
 				   unsigned int matchoff,
 				   unsigned int matchlen,
 				   struct nf_conntrack_expect *exp)
-				   __read_mostly;
+				   __rcu __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_amanda_hook);
 
 enum amanda_strings {
@@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
 	u_int16_t len;
 	__be16 port;
 	int ret = NF_ACCEPT;
-	typeof(nf_nat_amanda_hook) nf_nat_amanda;
+	unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
+				      enum ip_conntrack_info ctinfo,
+				      unsigned int protoff,
+				      unsigned int matchoff,
+				      unsigned int matchlen,
+				      struct nf_conntrack_expect *exp);
 
 	/* Only look at packets from the Amanda server */
 	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
@@ -155,7 +160,7 @@ static int amanda_help(struct sk_buff *skb,
 				  &tuple->src.u3, &tuple->dst.u3,
 				  IPPROTO_TCP, NULL, &port);
 
-		nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
+		nf_nat_amanda = rcu_dereference_raw(nf_nat_amanda_hook);
 		if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
 			ret = nf_nat_amanda(skb, ctinfo, protoff,
 					    off - dataoff, len, exp);
-- 
2.43.0

Re: [PATCH] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Florian Westphal]

Sun Jian <sun.jian.kdev@gmail.com> wrote:
> The nf_nat_amanda_hook pointer is accessed via rcu_dereference(), but
> it lacks the __rcu annotation in its declaration and definition. Sparse
> reports "incompatible types in comparison expression (different
> address spaces)" errors in nf_conntrack_amanda.c.
> 
> Fix this by:
> 1. Adding __rcu and __read_mostly to the global nf_nat_amanda_hook
>    declaration.
> 2. Adding __rcu to the global nf_nat_amanda_hook definition.
> 3. Explicitly declaring the local nf_nat_amanda function pointer
>    without __rcu to store the dereferenced pointer.
> 4. Using rcu_dereference_raw() to fetch the hook address, which
>    satisfies sparse's type checking for function pointers.

This doesn't look right, esp. step 4.  Why not:

diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -7,7 +7,7 @@
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack_expect.h>

-extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
+extern unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
                                          enum ip_conntrack_info ctinfo,
                                          unsigned int protoff,
                                          unsigned int matchoff,
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -37,7 +37,7 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 module_param(ts_algo, charp, 0400);
 MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");

-unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
+unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
                                   enum ip_conntrack_info ctinfo,
                                   unsigned int protoff,
                                   unsigned int matchoff,
?

Re: [PATCH] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[sun jian]

On Tue, Feb 3, 2026 at 9:50 PM Florian Westphal <fw@strlen.de> wrote:
>
> Sun Jian <sun.jian.kdev@gmail.com> wrote:

> > 4. Using rcu_dereference_raw() to fetch the hook address, which
> >    satisfies sparse's type checking for function pointers.
>
> This doesn't look right, esp. step 4.  Why not:
>
> diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
> --- a/include/linux/netfilter/nf_conntrack_amanda.h
> +++ b/include/linux/netfilter/nf_conntrack_amanda.h
> @@ -7,7 +7,7 @@
>  #include <linux/skbuff.h>
>  #include <net/netfilter/nf_conntrack_expect.h>
>
> -extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
> +extern unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
>                                           enum ip_conntrack_info ctinfo,
>                                           unsigned int protoff,
>                                           unsigned int matchoff,
> diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
> --- a/net/netfilter/nf_conntrack_amanda.c
> +++ b/net/netfilter/nf_conntrack_amanda.c
> @@ -37,7 +37,7 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
>  module_param(ts_algo, charp, 0400);
>  MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
>
> -unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
> +unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
>                                    enum ip_conntrack_info ctinfo,
>                                    unsigned int protoff,
>                                    unsigned int matchoff,
> ?
Ack, I'll follow your suggestions and send a V2 shortly.
Thanks for the correction!

Regards,

Sun

[PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Sun Jian]

Sparse reports "incompatible types in comparison expression" error in
nf_conntrack_amanda.c because nf_nat_amanda_hook is used with
rcu_dereference() but lacks the proper __rcu annotation.

Fix this by correctly placing the __rcu annotation inside the pointer
parentheses in both the declaration and definition. This allows the
standard rcu_dereference() to work correctly.

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
v2:
  - Correctly place __rcu annotation inside the parentheses as
    suggested by Florian Westphal.
  - Use standard rcu_dereference() instead of rcu_dereference_raw().
---
 include/linux/netfilter/nf_conntrack_amanda.h | 12 +++++------
 net/netfilter/nf_conntrack_amanda.c           | 21 ++++++++++++-------
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 6f0ac896fcc9..9f957598a9da 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -7,10 +7,10 @@
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 
-extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-					  enum ip_conntrack_info ctinfo,
-					  unsigned int protoff,
-					  unsigned int matchoff,
-					  unsigned int matchlen,
-					  struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+						enum ip_conntrack_info ctinfo,
+						unsigned int protoff,
+						unsigned int matchoff,
+						unsigned int matchlen,
+						struct nf_conntrack_expect *exp);
 #endif /* _NF_CONNTRACK_AMANDA_H */
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 7be4c35e4795..2e3753758b9b 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -37,13 +37,13 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 module_param(ts_algo, charp, 0400);
 MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
 
-unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-				   enum ip_conntrack_info ctinfo,
-				   unsigned int protoff,
-				   unsigned int matchoff,
-				   unsigned int matchlen,
-				   struct nf_conntrack_expect *exp)
-				   __read_mostly;
+unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+					 enum ip_conntrack_info ctinfo,
+					 unsigned int protoff,
+					 unsigned int matchoff,
+					 unsigned int matchlen,
+					 struct nf_conntrack_expect *exp)
+					 __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_amanda_hook);
 
 enum amanda_strings {
@@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
 	u_int16_t len;
 	__be16 port;
 	int ret = NF_ACCEPT;
-	typeof(nf_nat_amanda_hook) nf_nat_amanda;
+	unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
+				      enum ip_conntrack_info ctinfo,
+				      unsigned int protoff,
+				      unsigned int matchoff,
+				      unsigned int matchlen,
+				      struct nf_conntrack_expect *exp);
 
 	/* Only look at packets from the Amanda server */
 	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
-- 
2.43.0

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Florian Westphal]

Sun Jian <sun.jian.kdev@gmail.com> wrote:
>  enum amanda_strings {
> @@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
>  	u_int16_t len;
>  	__be16 port;
>  	int ret = NF_ACCEPT;
> -	typeof(nf_nat_amanda_hook) nf_nat_amanda;
> +	unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
> +				      enum ip_conntrack_info ctinfo,
> +				      unsigned int protoff,
> +				      unsigned int matchoff,
> +				      unsigned int matchlen,
> +				      struct nf_conntrack_expect *exp);

Why is that needed?

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[sun jian]

On Tue, Feb 3, 2026 at 11:04 PM Florian Westphal <fw@strlen.de> wrote:
>
> Sun Jian <sun.jian.kdev@gmail.com> wrote:
> >  enum amanda_strings {
> > @@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
> >       u_int16_t len;
> >       __be16 port;
> >       int ret = NF_ACCEPT;
> > -     typeof(nf_nat_amanda_hook) nf_nat_amanda;
> > +     unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
> > +                                   enum ip_conntrack_info ctinfo,
> > +                                   unsigned int protoff,
> > +                                   unsigned int matchoff,
> > +                                   unsigned int matchlen,
> > +                                   struct nf_conntrack_expect *exp);
>
> Why is that needed?
Correct. Manual declaration is indeed verbose.

The reason I used it was that typeof(nf_nat_amanda_hook) carries over
the __rcu attribute to the local variable, which triggers a Sparse
warning when assigning the result of rcu_dereference().

I will switch to typeof(*nf_nat_amanda_hook) *nf_nat_amanda in V3.
Thanks for the guidance!

Regards,

Sun

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Florian Westphal]

sun jian <sun.jian.kdev@gmail.com> wrote:
> > Sun Jian <sun.jian.kdev@gmail.com> wrote:
> > >  enum amanda_strings {
> > > @@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
> > >       u_int16_t len;
> > >       __be16 port;
> > >       int ret = NF_ACCEPT;
> > > -     typeof(nf_nat_amanda_hook) nf_nat_amanda;
> > > +     unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
> > > +                                   enum ip_conntrack_info ctinfo,
> > > +                                   unsigned int protoff,
> > > +                                   unsigned int matchoff,
> > > +                                   unsigned int matchlen,
> > > +                                   struct nf_conntrack_expect *exp);
> >
> > Why is that needed?
> Correct. Manual declaration is indeed verbose.
> 
> The reason I used it was that typeof(nf_nat_amanda_hook) carries over
> the __rcu attribute to the local variable, which triggers a Sparse
> warning when assigning the result of rcu_dereference().

sparse doesn't generate such a warning for me.

Also, this pattern you are changing here isn't specific to amanda, it
exists elsewhere as well:

net/netfilter/nf_conntrack_snmp.c:42:23: error: incompatible types in comparison expression (different address spaces):
net/netfilter/nf_conntrack_tftp.c:78:31: error: incompatible types in comparison expression (different address spaces):
net/netfilter/nf_conntrack_irc.c:242:38: error: incompatible types in comparison expression (different address spaces):
net/netfilter/nf_conntrack_ftp.c:521:22: error: incompatible types in comparison expression (different address spaces):

so why only fix this annotation for amanda?

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[sun jian]

On Wed, Feb 4, 2026 at 12:59 AM Florian Westphal <fw@strlen.de> wrote:
>
> sun jian <sun.jian.kdev@gmail.com> wrote:
> > > Sun Jian <sun.jian.kdev@gmail.com> wrote:
> > > >  enum amanda_strings {
> > > > @@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
> > > >       u_int16_t len;
> > > >       __be16 port;
> > > >       int ret = NF_ACCEPT;
> > > > -     typeof(nf_nat_amanda_hook) nf_nat_amanda;
> > > > +     unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
> > > > +                                   enum ip_conntrack_info ctinfo,
> > > > +                                   unsigned int protoff,
> > > > +                                   unsigned int matchoff,
> > > > +                                   unsigned int matchlen,
> > > > +                                   struct nf_conntrack_expect *exp);
> > >
> > > Why is that needed?
> > Correct. Manual declaration is indeed verbose.
> >
> > The reason I used it was that typeof(nf_nat_amanda_hook) carries over
> > the __rcu attribute to the local variable, which triggers a Sparse
> > warning when assigning the result of rcu_dereference().
>
> sparse doesn't generate such a warning for me.

I re-verified this with GCC 13.3.0 and Sparse v0.6.4-73-gfbdde312.
Even without LLVM=1, Sparse still reports the "different address spaces"
error for amanda on my machine:

net/netfilter/nf_conntrack_amanda.c:158:33: error: incompatible types
in comparison expression (different address spaces):
net/netfilter/nf_conntrack_amanda.c:158:33: unsigned int ( [noderef]
__rcu * )( ... ) net/netfilter/nf_conntrack_amanda.c:158:33: unsigned
int ( * )( ... )

It seems newer Sparse versions are more strict about RCU attributes on
function pointers.
To avoid manual declaration while stripping the __rcu attribute, I
will switch to:
typeof(*nf_nat_amanda_hook) *nf_nat_amanda;

>
> Also, this pattern you are changing here isn't specific to amanda, it
> exists elsewhere as well:
>
> net/netfilter/nf_conntrack_snmp.c:42:23: error: incompatible types in comparison expression (different address spaces):
> net/netfilter/nf_conntrack_tftp.c:78:31: error: incompatible types in comparison expression (different address spaces):
> net/netfilter/nf_conntrack_irc.c:242:38: error: incompatible types in comparison expression (different address spaces):
> net/netfilter/nf_conntrack_ftp.c:521:22: error: incompatible types in comparison expression (different address spaces):
>
> so why only fix this annotation for amanda?
Ack, I will prepare a V4 patch series to fix it for  amanda, snmp,
tftp, irc, and ftp together.

Regards,

Sun

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[sun jian]

Hi Florian,

One quick clarification to my previous email regarding the change at line 101.

While line 101 itself doesn't trigger a Sparse warning, using
typeof(nf_nat_amanda_hook)
causes the local variable to inherit the __rcu attribute. This
"attribute inheritance"
is what leads to the "different address spaces" error during
assignment at line 158
when using rcu_dereference().

To keep the code concise while stripping the RCU attribute, I'll use
the typeof(*hook) * pattern
as discussed. I am currently preparing the v4 patch series which will
apply this refined fix to all
affected helpers (amanda, ftp, irc, snmp, and tftp) to clean up these
Sparse warnings across
the subsystem.

Sorry for the confusion in the earlier thread.

Regards,

Sun

On Wed, Feb 4, 2026 at 9:56 AM sun jian <sun.jian.kdev@gmail.com> wrote:
>
> On Wed, Feb 4, 2026 at 12:59 AM Florian Westphal <fw@strlen.de> wrote:
> >
> > sun jian <sun.jian.kdev@gmail.com> wrote:
> > > > Sun Jian <sun.jian.kdev@gmail.com> wrote:
> > > > >  enum amanda_strings {
> > > > > @@ -98,7 +98,12 @@ static int amanda_help(struct sk_buff *skb,
> > > > >       u_int16_t len;
> > > > >       __be16 port;
> > > > >       int ret = NF_ACCEPT;
> > > > > -     typeof(nf_nat_amanda_hook) nf_nat_amanda;
> > > > > +     unsigned int (*nf_nat_amanda)(struct sk_buff *skb,
> > > > > +                                   enum ip_conntrack_info ctinfo,
> > > > > +                                   unsigned int protoff,
> > > > > +                                   unsigned int matchoff,
> > > > > +                                   unsigned int matchlen,
> > > > > +                                   struct nf_conntrack_expect *exp);
> > > >
> > > > Why is that needed?
> > > Correct. Manual declaration is indeed verbose.
> > >
> > > The reason I used it was that typeof(nf_nat_amanda_hook) carries over
> > > the __rcu attribute to the local variable, which triggers a Sparse
> > > warning when assigning the result of rcu_dereference().
> >
> > sparse doesn't generate such a warning for me.
>
> I re-verified this with GCC 13.3.0 and Sparse v0.6.4-73-gfbdde312.
> Even without LLVM=1, Sparse still reports the "different address spaces"
> error for amanda on my machine:
>
> net/netfilter/nf_conntrack_amanda.c:158:33: error: incompatible types
> in comparison expression (different address spaces):
> net/netfilter/nf_conntrack_amanda.c:158:33: unsigned int ( [noderef]
> __rcu * )( ... ) net/netfilter/nf_conntrack_amanda.c:158:33: unsigned
> int ( * )( ... )
>
> It seems newer Sparse versions are more strict about RCU attributes on
> function pointers.
> To avoid manual declaration while stripping the __rcu attribute, I
> will switch to:
> typeof(*nf_nat_amanda_hook) *nf_nat_amanda;
>
> >
> > Also, this pattern you are changing here isn't specific to amanda, it
> > exists elsewhere as well:
> >
> > net/netfilter/nf_conntrack_snmp.c:42:23: error: incompatible types in comparison expression (different address spaces):
> > net/netfilter/nf_conntrack_tftp.c:78:31: error: incompatible types in comparison expression (different address spaces):
> > net/netfilter/nf_conntrack_irc.c:242:38: error: incompatible types in comparison expression (different address spaces):
> > net/netfilter/nf_conntrack_ftp.c:521:22: error: incompatible types in comparison expression (different address spaces):
> >
> > so why only fix this annotation for amanda?
> Ack, I will prepare a V4 patch series to fix it for  amanda, snmp,
> tftp, irc, and ftp together.
>
> Regards,
>
> Sun

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[Florian Westphal]

sun jian <sun.jian.kdev@gmail.com> wrote:
> To keep the code concise while stripping the RCU attribute, I'll use
> the typeof(*hook) * pattern

No, please leave this alone, the code is fine as-is, all sparse warnings
are due to missing annotations only.

Re: [PATCH v2] netfilter: amanda: fix RCU pointer typing for nf_nat_amanda_hook

[sun jian]

On Wed, Feb 4, 2026 at 8:24 PM Florian Westphal <fw@strlen.de> wrote:
>
> sun jian <sun.jian.kdev@gmail.com> wrote:
> > To keep the code concise while stripping the RCU attribute, I'll use
> > the typeof(*hook) * pattern
>
> No, please leave this alone, the code is fine as-is, all sparse warnings
> are due to missing annotations only.
Ack. You are right: I've double-checked  my environment and confirmed
that adding the __rcu is sufficient to resolve those warnings.

I will just annotate them and leave other code as-is. V4 is on the way.

Regards,
sun jian

[PATCH v4 0/5] netfilter: annotate NAT helper hook pointers with __rcu

[Sun Jian]

This series adds the missing __rcu annotations to NAT helper hook
pointers across several netfilter helper modules.

These global hook pointers are updated and dereferenced under RCU rules,
so their types should be annotated accordingly. This is a pure annotation
change (no functional changes), and it also improves static checking.

Changes since v2: (no v3 posted)
  - Extend the series from nf_nat_amanda to the other NAT helpers
    (ftp/irc/snmp/tftp).
  - Keep the changes limited to __rcu annotations on the global hook
    pointer declarations/definitions only (no functional changes).

v2:
  - Place __rcu annotation inside parentheses (per Florian Westphal).
  - Use rcu_dereference() instead of rcu_dereference_raw().

Sun Jian (5):
  netfilter: amanda: annotate nf_nat_amanda_hook with __rcu
  netfilter: ftp: annotate nf_nat_ftp_hook with __rcu
  netfilter: irc: annotate nf_nat_irc_hook with __rcu
  netfilter: snmp: annotate nf_nat_snmp_hook with __rcu
  netfilter: tftp: annotate nf_nat_tftp_hook with __rcu

 include/linux/netfilter/nf_conntrack_amanda.h | 12 ++++++------
 include/linux/netfilter/nf_conntrack_ftp.h    |  2 +-
 include/linux/netfilter/nf_conntrack_irc.h    |  2 +-
 include/linux/netfilter/nf_conntrack_snmp.h   |  2 +-
 include/linux/netfilter/nf_conntrack_tftp.h   |  2 +-
 net/netfilter/nf_conntrack_amanda.c           | 14 +++++++-------
 net/netfilter/nf_conntrack_ftp.c              |  2 +-
 net/netfilter/nf_conntrack_irc.c              |  2 +-
 net/netfilter/nf_conntrack_snmp.c             |  2 +-
 net/netfilter/nf_conntrack_tftp.c             |  2 +-
 10 files changed, 21 insertions(+), 21 deletions(-)

-- 
2.43.0

[PATCH v4 1/5] netfilter: amanda: annotate nf_nat_amanda_hook with __rcu

[Sun Jian]

The nf_nat_amanda_hook is an RCU-protected pointer but lacks the
proper __rcu annotation. Add the annotation to ensure the declaration
correctly reflects its usage via rcu_dereference().

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_amanda.h | 12 ++++++------
 net/netfilter/nf_conntrack_amanda.c           | 14 +++++++-------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 6f0ac896fcc9..9f957598a9da 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -7,10 +7,10 @@
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 
-extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-					  enum ip_conntrack_info ctinfo,
-					  unsigned int protoff,
-					  unsigned int matchoff,
-					  unsigned int matchlen,
-					  struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+						enum ip_conntrack_info ctinfo,
+						unsigned int protoff,
+						unsigned int matchoff,
+						unsigned int matchlen,
+						struct nf_conntrack_expect *exp);
 #endif /* _NF_CONNTRACK_AMANDA_H */
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 7be4c35e4795..c0132559f6af 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -37,13 +37,13 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 module_param(ts_algo, charp, 0400);
 MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
 
-unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-				   enum ip_conntrack_info ctinfo,
-				   unsigned int protoff,
-				   unsigned int matchoff,
-				   unsigned int matchlen,
-				   struct nf_conntrack_expect *exp)
-				   __read_mostly;
+unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+					 enum ip_conntrack_info ctinfo,
+					 unsigned int protoff,
+					 unsigned int matchoff,
+					 unsigned int matchlen,
+					 struct nf_conntrack_expect *exp)
+					 __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_amanda_hook);
 
 enum amanda_strings {
-- 
2.43.0

[PATCH v4 2/5] netfilter: ftp: annotate nf_nat_ftp_hook with __rcu

[Sun Jian]

The nf_nat_ftp_hook is an RCU-protected pointer but lacks the
proper __rcu annotation. Add the annotation to ensure the declaration
correctly reflects its usage via rcu_dereference().

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_ftp.h | 2 +-
 net/netfilter/nf_conntrack_ftp.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
index 0e38302820b9..f31292642035 100644
--- a/include/linux/netfilter/nf_conntrack_ftp.h
+++ b/include/linux/netfilter/nf_conntrack_ftp.h
@@ -26,7 +26,7 @@ struct nf_ct_ftp_master {
 
 /* For NAT to hook in when we find a packet which describes what other
  * connection we should expect. */
-extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
+extern unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
 				       enum ip_conntrack_info ctinfo,
 				       enum nf_ct_ftp_type type,
 				       unsigned int protoff,
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 617f744a2e3a..74811893dec4 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -43,7 +43,7 @@ module_param_array(ports, ushort, &ports_c, 0400);
 static bool loose;
 module_param(loose, bool, 0600);
 
-unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
+unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
 				enum ip_conntrack_info ctinfo,
 				enum nf_ct_ftp_type type,
 				unsigned int protoff,
-- 
2.43.0

Re: [PATCH v4 2/5] netfilter: ftp: annotate nf_nat_ftp_hook with __rcu

[Florian Westphal]

Sun Jian <sun.jian.kdev@gmail.com> wrote:
> diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
> index 0e38302820b9..f31292642035 100644
> --- a/include/linux/netfilter/nf_conntrack_ftp.h
> +++ b/include/linux/netfilter/nf_conntrack_ftp.h
> @@ -26,7 +26,7 @@ struct nf_ct_ftp_master {
>  
>  /* For NAT to hook in when we find a packet which describes what other
>   * connection we should expect. */
> -extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
> +extern unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
>  				       enum ip_conntrack_info ctinfo,
>  				       enum nf_ct_ftp_type type,
>  				       unsigned int protoff,

Patch 1 re-indents, the rest doesn't.

> diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
> index 617f744a2e3a..74811893dec4 100644
> --- a/net/netfilter/nf_conntrack_ftp.c
> +++ b/net/netfilter/nf_conntrack_ftp.c
> @@ -43,7 +43,7 @@ module_param_array(ports, ushort, &ports_c, 0400);
>  static bool loose;
>  module_param(loose, bool, 0600);
>  
> -unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
> +unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
>  				enum ip_conntrack_info ctinfo,
>  				enum nf_ct_ftp_type type,
>  				unsigned int protoff,

CHECK: Alignment should match open parenthesis
#135: FILE: net/netfilter/nf_conntrack_ftp.c:47:
+unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,

Please re-indent in .c and check that checkpatch.pl doesn't complain.

Also, no need to send this in multiple patches, its one logical
annotation change.

Re: [PATCH v4 2/5] netfilter: ftp: annotate nf_nat_ftp_hook with __rcu

[sun jian]

On Thu, Feb 5, 2026 at 6:00 PM Florian Westphal <fw@strlen.de> wrote:
>
> Sun Jian <sun.jian.kdev@gmail.com> wrote:
>
> Patch 1 re-indents, the rest doesn't.
>
> > diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
> CHECK: Alignment should match open parenthesis
> #135: FILE: net/netfilter/nf_conntrack_ftp.c:47:
> +unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
>                                 enum ip_conntrack_info ctinfo,
>
> Please re-indent in .c and check that checkpatch.pl doesn't complain.
>
> Also, no need to send this in multiple patches, its one logical
> annotation change.

Ack. I'll squash these into a single patch and fix the alignment issues.
v5 is coming soon.

Regards,
sun jian

[PATCH v5] netfilter: annotate NAT helper hook pointers with __rcu

[Sun Jian]

The NAT helper hook pointers are updated and dereferenced under RCU rules,
but lack the proper __rcu annotation.

This makes sparse report address space mismatches when the hooks are used
with rcu_dereference().

Add the missing __rcu annotations to the global hook pointer declarations
and definitions in Amanda, FTP, IRC, SNMP and TFTP.

No functional change intended.

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
v5:
  - Squash previous 5-patch series into a single patch (per Florian).
  - Fix parameter alignment in .h and .c files to match the opening
    parenthesis.

v4:
  - Extend the change from amanda to the other NAT helpers (ftp/irc/snmp/tftp).
  - Drop the proposed code simplification (typeof pattern).

v2:
  - Place __rcu annotation inside the pointer parentheses (per Florian).
  - Return to use standard rcu_dereference() instead of rcu_dereference_raw().

(no v3 posted)
---
 include/linux/netfilter/nf_conntrack_amanda.h | 12 ++++++------
 include/linux/netfilter/nf_conntrack_ftp.h    | 14 +++++++-------
 include/linux/netfilter/nf_conntrack_irc.h    | 12 ++++++------
 include/linux/netfilter/nf_conntrack_snmp.h   |  2 +-
 include/linux/netfilter/nf_conntrack_tftp.h   |  6 +++---
 net/netfilter/nf_conntrack_amanda.c           | 14 +++++++-------
 net/netfilter/nf_conntrack_ftp.c              | 14 +++++++-------
 net/netfilter/nf_conntrack_irc.c              | 13 +++++++------
 net/netfilter/nf_conntrack_snmp.c             |  8 ++++----
 net/netfilter/nf_conntrack_tftp.c             |  7 ++++---
 10 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 6f0ac896fcc9..9f957598a9da 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -7,10 +7,10 @@
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 
-extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-					  enum ip_conntrack_info ctinfo,
-					  unsigned int protoff,
-					  unsigned int matchoff,
-					  unsigned int matchlen,
-					  struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+						enum ip_conntrack_info ctinfo,
+						unsigned int protoff,
+						unsigned int matchoff,
+						unsigned int matchlen,
+						struct nf_conntrack_expect *exp);
 #endif /* _NF_CONNTRACK_AMANDA_H */
diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
index 0e38302820b9..939c847213b4 100644
--- a/include/linux/netfilter/nf_conntrack_ftp.h
+++ b/include/linux/netfilter/nf_conntrack_ftp.h
@@ -26,11 +26,11 @@ struct nf_ct_ftp_master {
 
 /* For NAT to hook in when we find a packet which describes what other
  * connection we should expect. */
-extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
-				       enum ip_conntrack_info ctinfo,
-				       enum nf_ct_ftp_type type,
-				       unsigned int protoff,
-				       unsigned int matchoff,
-				       unsigned int matchlen,
-				       struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
+					     enum ip_conntrack_info ctinfo,
+					     enum nf_ct_ftp_type type,
+					     unsigned int protoff,
+					     unsigned int matchoff,
+					     unsigned int matchlen,
+					     struct nf_conntrack_expect *exp);
 #endif /* _NF_CONNTRACK_FTP_H */
diff --git a/include/linux/netfilter/nf_conntrack_irc.h b/include/linux/netfilter/nf_conntrack_irc.h
index d02255f721e1..14ad5bfaad81 100644
--- a/include/linux/netfilter/nf_conntrack_irc.h
+++ b/include/linux/netfilter/nf_conntrack_irc.h
@@ -8,11 +8,11 @@
 
 #define IRC_PORT	6667
 
-extern unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
-				       enum ip_conntrack_info ctinfo,
-				       unsigned int protoff,
-				       unsigned int matchoff,
-				       unsigned int matchlen,
-				       struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_irc_hook)(struct sk_buff *skb,
+					     enum ip_conntrack_info ctinfo,
+					     unsigned int protoff,
+					     unsigned int matchoff,
+					     unsigned int matchlen,
+					     struct nf_conntrack_expect *exp);
 
 #endif /* _NF_CONNTRACK_IRC_H */
diff --git a/include/linux/netfilter/nf_conntrack_snmp.h b/include/linux/netfilter/nf_conntrack_snmp.h
index 87e4f33eb55f..99107e4f5234 100644
--- a/include/linux/netfilter/nf_conntrack_snmp.h
+++ b/include/linux/netfilter/nf_conntrack_snmp.h
@@ -5,7 +5,7 @@
 #include <linux/netfilter.h>
 #include <linux/skbuff.h>
 
-extern int (*nf_nat_snmp_hook)(struct sk_buff *skb,
+extern int (__rcu *nf_nat_snmp_hook)(struct sk_buff *skb,
 				unsigned int protoff,
 				struct nf_conn *ct,
 				enum ip_conntrack_info ctinfo);
diff --git a/include/linux/netfilter/nf_conntrack_tftp.h b/include/linux/netfilter/nf_conntrack_tftp.h
index dc4c1b9beac0..05c72d0bc98d 100644
--- a/include/linux/netfilter/nf_conntrack_tftp.h
+++ b/include/linux/netfilter/nf_conntrack_tftp.h
@@ -19,8 +19,8 @@ struct tftphdr {
 #define TFTP_OPCODE_ACK		4
 #define TFTP_OPCODE_ERROR	5
 
-extern unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
-				        enum ip_conntrack_info ctinfo,
-				        struct nf_conntrack_expect *exp);
+extern unsigned int (__rcu *nf_nat_tftp_hook)(struct sk_buff *skb,
+					      enum ip_conntrack_info ctinfo,
+					      struct nf_conntrack_expect *exp);
 
 #endif /* _NF_CONNTRACK_TFTP_H */
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 7be4c35e4795..c0132559f6af 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -37,13 +37,13 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 module_param(ts_algo, charp, 0400);
 MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
 
-unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
-				   enum ip_conntrack_info ctinfo,
-				   unsigned int protoff,
-				   unsigned int matchoff,
-				   unsigned int matchlen,
-				   struct nf_conntrack_expect *exp)
-				   __read_mostly;
+unsigned int (__rcu *nf_nat_amanda_hook)(struct sk_buff *skb,
+					 enum ip_conntrack_info ctinfo,
+					 unsigned int protoff,
+					 unsigned int matchoff,
+					 unsigned int matchlen,
+					 struct nf_conntrack_expect *exp)
+					 __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_amanda_hook);
 
 enum amanda_strings {
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 617f744a2e3a..5e00f9123c38 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -43,13 +43,13 @@ module_param_array(ports, ushort, &ports_c, 0400);
 static bool loose;
 module_param(loose, bool, 0600);
 
-unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
-				enum ip_conntrack_info ctinfo,
-				enum nf_ct_ftp_type type,
-				unsigned int protoff,
-				unsigned int matchoff,
-				unsigned int matchlen,
-				struct nf_conntrack_expect *exp);
+unsigned int (__rcu *nf_nat_ftp_hook)(struct sk_buff *skb,
+				      enum ip_conntrack_info ctinfo,
+				      enum nf_ct_ftp_type type,
+				      unsigned int protoff,
+				      unsigned int matchoff,
+				      unsigned int matchlen,
+				      struct nf_conntrack_expect *exp);
 EXPORT_SYMBOL_GPL(nf_nat_ftp_hook);
 
 static int try_rfc959(const char *, size_t, struct nf_conntrack_man *,
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 5703846bea3b..b8e6d724acd1 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -30,12 +30,13 @@ static unsigned int dcc_timeout __read_mostly = 300;
 static char *irc_buffer;
 static DEFINE_SPINLOCK(irc_buffer_lock);
 
-unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
-				enum ip_conntrack_info ctinfo,
-				unsigned int protoff,
-				unsigned int matchoff,
-				unsigned int matchlen,
-				struct nf_conntrack_expect *exp) __read_mostly;
+unsigned int (__rcu *nf_nat_irc_hook)(struct sk_buff *skb,
+				      enum ip_conntrack_info ctinfo,
+				      unsigned int protoff,
+				      unsigned int matchoff,
+				      unsigned int matchlen,
+				      struct nf_conntrack_expect *exp)
+				      __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_irc_hook);
 
 #define HELPER_NAME "irc"
diff --git a/net/netfilter/nf_conntrack_snmp.c b/net/netfilter/nf_conntrack_snmp.c
index daacf2023fa5..387dd6e58f88 100644
--- a/net/netfilter/nf_conntrack_snmp.c
+++ b/net/netfilter/nf_conntrack_snmp.c
@@ -25,10 +25,10 @@ static unsigned int timeout __read_mostly = 30;
 module_param(timeout, uint, 0400);
 MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
 
-int (*nf_nat_snmp_hook)(struct sk_buff *skb,
-			unsigned int protoff,
-			struct nf_conn *ct,
-			enum ip_conntrack_info ctinfo);
+int (__rcu *nf_nat_snmp_hook)(struct sk_buff *skb,
+			      unsigned int protoff,
+			      struct nf_conn *ct,
+			      enum ip_conntrack_info ctinfo);
 EXPORT_SYMBOL_GPL(nf_nat_snmp_hook);
 
 static int snmp_conntrack_help(struct sk_buff *skb, unsigned int protoff,
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 80ee53f29f68..89e9914e5d03 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -32,9 +32,10 @@ static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
 
-unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
-				 enum ip_conntrack_info ctinfo,
-				 struct nf_conntrack_expect *exp) __read_mostly;
+unsigned int (__rcu *nf_nat_tftp_hook)(struct sk_buff *skb,
+				       enum ip_conntrack_info ctinfo,
+				       struct nf_conntrack_expect *exp)
+				       __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);
 
 static int tftp_help(struct sk_buff *skb,
-- 
2.43.0

[PATCH v4 3/5] netfilter: irc: annotate nf_nat_irc_hook with __rcu

[Sun Jian]

The nf_nat_irc_hook is an RCU-protected pointer but lacks the
proper __rcu annotation. Add the annotation to ensure the declaration
correctly reflects its usage via rcu_dereference().

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_irc.h | 2 +-
 net/netfilter/nf_conntrack_irc.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_irc.h b/include/linux/netfilter/nf_conntrack_irc.h
index d02255f721e1..4f3ca5621998 100644
--- a/include/linux/netfilter/nf_conntrack_irc.h
+++ b/include/linux/netfilter/nf_conntrack_irc.h
@@ -8,7 +8,7 @@
 
 #define IRC_PORT	6667
 
-extern unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
+extern unsigned int (__rcu *nf_nat_irc_hook)(struct sk_buff *skb,
 				       enum ip_conntrack_info ctinfo,
 				       unsigned int protoff,
 				       unsigned int matchoff,
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 5703846bea3b..76c007530b3c 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -30,7 +30,7 @@ static unsigned int dcc_timeout __read_mostly = 300;
 static char *irc_buffer;
 static DEFINE_SPINLOCK(irc_buffer_lock);
 
-unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
+unsigned int (__rcu *nf_nat_irc_hook)(struct sk_buff *skb,
 				enum ip_conntrack_info ctinfo,
 				unsigned int protoff,
 				unsigned int matchoff,
-- 
2.43.0

[PATCH v4 4/5] netfilter: snmp: annotate nf_nat_snmp_hook with __rcu

[Sun Jian]

The nf_nat_snmp_hook is an RCU-protected pointer but lacks the
proper __rcu annotation. Add the annotation to ensure the declaration
correctly reflects its usage via rcu_dereference().

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_snmp.h | 2 +-
 net/netfilter/nf_conntrack_snmp.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_snmp.h b/include/linux/netfilter/nf_conntrack_snmp.h
index 87e4f33eb55f..99107e4f5234 100644
--- a/include/linux/netfilter/nf_conntrack_snmp.h
+++ b/include/linux/netfilter/nf_conntrack_snmp.h
@@ -5,7 +5,7 @@
 #include <linux/netfilter.h>
 #include <linux/skbuff.h>
 
-extern int (*nf_nat_snmp_hook)(struct sk_buff *skb,
+extern int (__rcu *nf_nat_snmp_hook)(struct sk_buff *skb,
 				unsigned int protoff,
 				struct nf_conn *ct,
 				enum ip_conntrack_info ctinfo);
diff --git a/net/netfilter/nf_conntrack_snmp.c b/net/netfilter/nf_conntrack_snmp.c
index daacf2023fa5..34f6624fbcfb 100644
--- a/net/netfilter/nf_conntrack_snmp.c
+++ b/net/netfilter/nf_conntrack_snmp.c
@@ -25,7 +25,7 @@ static unsigned int timeout __read_mostly = 30;
 module_param(timeout, uint, 0400);
 MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
 
-int (*nf_nat_snmp_hook)(struct sk_buff *skb,
+int (__rcu *nf_nat_snmp_hook)(struct sk_buff *skb,
 			unsigned int protoff,
 			struct nf_conn *ct,
 			enum ip_conntrack_info ctinfo);
-- 
2.43.0

[PATCH v4 5/5] netfilter: tftp: annotate nf_nat_tftp_hook with __rcu

[Sun Jian]

The nf_nat_tftp_hook is an RCU-protected pointer but lacks the
proper __rcu annotation. Add the annotation to ensure the declaration
correctly reflects its usage via rcu_dereference().

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
---
 include/linux/netfilter/nf_conntrack_tftp.h | 2 +-
 net/netfilter/nf_conntrack_tftp.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_tftp.h b/include/linux/netfilter/nf_conntrack_tftp.h
index dc4c1b9beac0..1490b68dd7d1 100644
--- a/include/linux/netfilter/nf_conntrack_tftp.h
+++ b/include/linux/netfilter/nf_conntrack_tftp.h
@@ -19,7 +19,7 @@ struct tftphdr {
 #define TFTP_OPCODE_ACK		4
 #define TFTP_OPCODE_ERROR	5
 
-extern unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
+extern unsigned int (__rcu *nf_nat_tftp_hook)(struct sk_buff *skb,
 				        enum ip_conntrack_info ctinfo,
 				        struct nf_conntrack_expect *exp);
 
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 80ee53f29f68..c6d8c2e80661 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -32,7 +32,7 @@ static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
 
-unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
+unsigned int (__rcu *nf_nat_tftp_hook)(struct sk_buff *skb,
 				 enum ip_conntrack_info ctinfo,
 				 struct nf_conntrack_expect *exp) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);
-- 
2.43.0