[PATCH nf] ipvs: clear the nfct flag under lock

[Julian Anastasov <ja@xxxxxx>]

Sashiko warns that cp->flags should be changed under cp->lock

Fixes: 35dfb013149f ("ipvs: queue delayed work to expire no destination 
connections if expire_nodest_conn=1")
Fixes: f0a5e4d7a594 ("ipvs: allow connection reuse for unconfirmed conntrack")
Link: 
https://sashiko.dev/#/patchset/CALMqdkR704S2BG_QD_bgHTFp2%2B1QCi7n0T4zoZyTo8mDZevYSA%40mail.gmail.com
Signed-off-by: Julian Anastasov <ja@xxxxxx>
---
 net/netfilter/ipvs/ip_vs_core.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 7efa209a517b..6b79e0c4d9e2 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -2194,8 +2194,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const 
struct nf_hook_state *state
                }
 
                if (resched) {
-                       if (!old_ct)
+                       if (!old_ct) {
+                               spin_lock_bh(&cp->lock);
                                cp->flags &= ~IP_VS_CONN_F_NFCT;
+                               spin_unlock_bh(&cp->lock);
+                       }
                        if (!atomic_read(&cp->n_control))
                                ip_vs_conn_expire_now(cp);
                        __ip_vs_conn_put(cp);
@@ -2211,8 +2214,11 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const 
struct nf_hook_state *state
                if (sysctl_expire_nodest_conn(ipvs)) {
                        bool old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
 
-                       if (!old_ct)
+                       if (!old_ct) {
+                               spin_lock_bh(&cp->lock);
                                cp->flags &= ~IP_VS_CONN_F_NFCT;
+                               spin_unlock_bh(&cp->lock);
+                       }
 
                        ip_vs_conn_expire_now(cp);
                        __ip_vs_conn_put(cp);
-- 
2.55.0