From: patchwork-bot+netdevbpf@kernel.org
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org, davem@davemloft.net,
netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com,
edumazet@google.com, fw@strlen.de, horms@kernel.org
Subject: Re: [PATCH net 01/14] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
Date: Thu, 25 Jun 2026 03:00:52 +0000 [thread overview]
Message-ID: <178235645227.3097853.18361949927690415910.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20260623221548.701545-2-pablo@netfilter.org>
Hello:
This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Wed, 24 Jun 2026 00:15:34 +0200 you wrote:
> From: Mathias Krause <minipli@grsecurity.net>
>
> We ran into below KASAN splat, which is mostly uninteresting, beside
> for having nf_nat_register_fn() in the call chain as a cause for the
> offending access:
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in nf_nat_register_fn+0x5f9/0x640
> Read of size 8 at addr ffff890031e54c20 by task iptables/9510
>
> [...]
Here is the summary with links:
- [net,01/14] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
https://git.kernel.org/netdev/net/c/069cfe3de2a5
- [net,02/14] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
https://git.kernel.org/netdev/net/c/c8b6f36f7669
- [net,03/14] netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
https://git.kernel.org/netdev/net/c/84460b644329
- [net,04/14] netfilter: x_tables.h: fix all kernel-doc warnings
https://git.kernel.org/netdev/net/c/22f9dbed18bc
- [net,05/14] netfilter: nft_synproxy: stop bypassing the priv->info snapshot
https://git.kernel.org/netdev/net/c/11d4bc4e26fb
- [net,06/14] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test
https://git.kernel.org/netdev/net/c/a49a8e51eebc
- [net,07/14] netfilter: nft_compat: ebtables emulation must reject non-bridge targets
https://git.kernel.org/netdev/net/c/9dbba7e694ec
- [net,08/14] selftests: nft_queue.sh: add a bridge queue test
https://git.kernel.org/netdev/net/c/8a2cfe7951f6
- [net,09/14] netfilter: ctnetlink: do not allow to reset helper on existing conntrack
https://git.kernel.org/netdev/net/c/aaa0cd698ffa
- [net,10/14] netfilter: conntrack: add deprecation warnings for irc and pptp trackers
https://git.kernel.org/netdev/net/c/57f940017a77
- [net,11/14] netfilter: nf_conntrack_expect: store master_tuple in expectation
https://git.kernel.org/netdev/net/c/979c13114c0b
- [net,12/14] netfilter: nf_conntrack_expect: run expectation eviction with no helper
https://git.kernel.org/netdev/net/c/be57dd9c1c17
- [net,13/14] netfilter: nft_ct: expectation timeouts are passed in milliseconds
https://git.kernel.org/netdev/net/c/6fb421bd07f1
- [net,14/14] netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration
https://git.kernel.org/netdev/net/c/397c8300972f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
next prev parent reply other threads:[~2026-06-25 3:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-23 22:15 [PATCH net 00/14] Netfilter fixes for net Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 01/14] netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() Pablo Neira Ayuso
2026-06-25 3:00 ` patchwork-bot+netdevbpf [this message]
2026-06-23 22:15 ` [PATCH net 02/14] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 03/14] netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 04/14] netfilter: x_tables.h: fix all kernel-doc warnings Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 05/14] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 06/14] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 07/14] netfilter: nft_compat: ebtables emulation must reject non-bridge targets Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 08/14] selftests: nft_queue.sh: add a bridge queue test Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 09/14] netfilter: ctnetlink: do not allow to reset helper on existing conntrack Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 10/14] netfilter: conntrack: add deprecation warnings for irc and pptp trackers Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 11/14] netfilter: nf_conntrack_expect: store master_tuple in expectation Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 12/14] netfilter: nf_conntrack_expect: run expectation eviction with no helper Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 13/14] netfilter: nft_ct: expectation timeouts are passed in milliseconds Pablo Neira Ayuso
2026-06-23 22:15 ` [PATCH net 14/14] netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178235645227.3097853.18361949927690415910.git-patchwork-notify@kernel.org \
--to=patchwork-bot+netdevbpf@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.