[PATCH 0/9 nf-next] netfilter: replace raw warnings with

[Fernando Fernandez Mancera <fmancera@suse.de>]

This patch series replaces raw WARN_ON and WARN_ON_ONCE macros with
DEBUG_NET_WARN_ON_ONCE across various netfilter subsystems.

Currently, several internal invariant checks use standard warnings on
packet processing paths or control-plane loops. If triggered, these can
trigger full system panics when panic_on_warn=1 is enabled. In most of
these cases, the condition is already handled gracefully by dropping the
packet, applying a defensive fallback, or returning a proper error code
to userspace via netlink.

By migrating to DEBUG_NET_WARN_ON_ONCE, we preserve full stack trace
diagnostic capability for developers running kernels compiled with
CONFIG_DEBUG_NET=y, while protecting production environments from system
panics.

Fernando Fernandez Mancera (9):
  netfilter: xtables: use DEBUG_NET_WARN_ON_ONCE in packet and control
    paths
  netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control
    paths
  netfilter: nfnetlink: use DEBUG_NET_WARN_ON_ONCE for attribute
    validation
  netfilter: conntrack: use DEBUG_NET_WARN_ON_ONCE on packet paths
  netfilter: nat: use DEBUG_NET_WARN_ON_ONCE in core and helper paths
  netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
  netfilter: bpf: use DEBUG_NET_WARN_ON_ONCE for missing BTF structures
  netfilter: flowtable: use DEBUG_NET_WARN_ON_ONCE in offload path
  netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count
    limit

 net/ipv4/netfilter/ip_tables.c          |  6 ++--
 net/ipv4/netfilter/iptable_nat.c        |  4 ++-
 net/ipv4/netfilter/nf_nat_pptp.c        | 16 +++++++---
 net/ipv4/netfilter/nf_tproxy_ipv4.c     |  2 +-
 net/ipv6/netfilter/ip6_tables.c         |  6 ++--
 net/ipv6/netfilter/ip6table_nat.c       |  4 ++-
 net/ipv6/netfilter/nf_tproxy_ipv6.c     |  2 +-
 net/netfilter/nf_bpf_link.c             |  4 ++-
 net/netfilter/nf_conncount.c            |  3 +-
 net/netfilter/nf_conntrack_core.c       |  2 +-
 net/netfilter/nf_conntrack_extend.c     |  3 +-
 net/netfilter/nf_conntrack_helper.c     |  4 ++-
 net/netfilter/nf_conntrack_ovs.c        |  2 +-
 net/netfilter/nf_conntrack_proto_icmp.c |  3 +-
 net/netfilter/nf_conntrack_seqadj.c     |  2 +-
 net/netfilter/nf_conntrack_sip.c        |  5 +++-
 net/netfilter/nf_flow_table_core.c      |  4 +--
 net/netfilter/nf_flow_table_ip.c        |  4 +--
 net/netfilter/nf_flow_table_offload.c   |  4 +--
 net/netfilter/nf_nat_core.c             | 39 +++++++++++++++++--------
 net/netfilter/nf_nat_masquerade.c       |  6 ++--
 net/netfilter/nf_nat_proto.c            | 14 +++++----
 net/netfilter/nf_nat_redirect.c         |  5 ++--
 net/netfilter/nf_tables_api.c           | 38 +++++++++++++++++-------
 net/netfilter/nf_tables_core.c          |  8 +++--
 net/netfilter/nf_tables_offload.c       |  2 +-
 net/netfilter/nf_tables_trace.c         |  6 ++--
 net/netfilter/nfnetlink.c               |  4 ++-
 net/netfilter/nfnetlink_cttimeout.c     |  3 +-
 net/netfilter/nft_ct.c                  |  2 +-
 net/netfilter/nft_ct_fast.c             |  2 +-
 net/netfilter/nft_exthdr.c              |  2 +-
 net/netfilter/nft_fib.c                 |  2 +-
 net/netfilter/nft_inner.c               |  2 +-
 net/netfilter/nft_lookup.c              |  2 +-
 net/netfilter/nft_masq.c                |  2 +-
 net/netfilter/nft_meta.c                | 10 +++----
 net/netfilter/nft_payload.c             |  6 ++--
 net/netfilter/nft_redir.c               |  2 +-
 net/netfilter/nft_reject.c              |  8 +++--
 net/netfilter/nft_rt.c                  |  2 +-
 net/netfilter/nft_set_hash.c            |  2 +-
 net/netfilter/nft_set_pipapo.c          |  2 +-
 net/netfilter/nft_set_rbtree.c          |  6 ++--
 net/netfilter/nft_socket.c              |  8 +++--
 net/netfilter/nft_tunnel.c              |  2 +-
 net/netfilter/nft_xfrm.c                |  6 ++--
 net/netfilter/x_tables.c                | 12 ++++++--
 net/netfilter/xt_NETMAP.c               |  4 ---
 net/netfilter/xt_cluster.c              |  4 +--
 net/netfilter/xt_nat.c                  | 30 +++++++++----------
 net/netfilter/xt_socket.c               |  3 +-
 52 files changed, 203 insertions(+), 123 deletions(-)

-- 
2.54.0