Commit 8d96dfdc authored by Fernando Fernandez Mancera's avatar Fernando Fernandez Mancera Committed by Florian Westphal
Browse files

netfilter: nft_connlimit: fix possible data race on connection count 



nft_connlimit_eval() reads priv->list->count to check if the connection
limit has been exceeded. This value is being read without a lock and can
be modified by a different process. Use READ_ONCE() for correctness.

Fixes: df4a9025 ("netfilter: nf_conncount: merge lookup and add functions")
Signed-off-by: default avatarFernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 514f1dc8

net/netfilter/nft_connlimit.c

+1 −1
Original line number Diff line number Diff line
@@ -48,7 +48,7 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv, 
		return;

	}



	count = priv->list->count;

	count = READ_ONCE(priv->list->count);



	if ((count > priv->limit) ^ priv->invert) {

		regs->verdict.code = NFT_BREAK;