[PATCH net 00/13] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS fixes for net. Still
large batch for this late -rc cycle but at least have of these fixes in
this batch have been cooking for several weeks before:

1) Fix race between ipset list:set GC and swap, use write_lock instead
   of rcu read lock section when accessing the index to ensure
   interference with ip_set_swap(), from Xiang Mei.

2) Release template conntrack in bridge conntrack when packet is
   neither IPv4 nor IPv6 before setting skb as untracked.
   From Zhiling Zou.

3) A series of 3 patches for IPVS to address sashiko reports:
   Schedulers read destination overload state while connection
   accounting and destination configuration can update it concurrently.
   The first patch adds a single total connection counter. The second
   patch uses it to identify threshold crossings precisely, and updates
   OVERLOAD at the crossings and on a threshold edit under dst_lock.
   The third patch moves configuration-controlled AVAILABLE to a
   separate cflags word, so it cannot clobber OVERLOAD through an
   unrelated read-modify-write update.

4) Log invalid packets in TCP and SCTP connection tracking to address
   a deadlock when nfnetlink_log is used as logging backend and the
   nfnetlink_log conntrack glue support is used. From Zihan Xi.

5) Wait for rcu grace period before releasing pernet state in
   nfnetlink_log, otherwise packets can end up access already released
   memory, triggering UaF. From Florian Westphal.

6) IPVS needs to reset IP information in control buffer in skbuff when
   encapsulating IP packets in ICMP, from Kyle Zeng.

7) IPVS needs to validate ihl field of inner headers in when handling
   ICMP response, from Julian Anastasov.

8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload
   when triggering ENOMEM on GFP_KERNEL allocation,
   from Alexey Velichayshiy.

9) Publish reply tuple into the flowtable hashtable first, otherwise
   GC might walk over a released tuple when insertion of the original
   tuple fail. From Jeremy Jean.

10) Elide counter increment when replacing an ipset element,
    from Florian Westphal.

11) Remove unneeded ipset accounting resets on destruction/flush,
    from Florian Westphal.

Sashiko reports pre-existing 8-bit shift and overflow in IPVS which is
planned to be addressed as follow ups.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-08-10

Thanks.

----------------------------------------------------------------

The following changes since commit dd057113ac7ba5bdd2aed3d9405305911152f911:

  mailmap: add entries for Christoph Paasch (2026-08-07 18:20:12 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-08-10

for you to fetch changes up to 490937b88cb592cc0c5367758edd700fd5abd15c:

  netfilter: ipset: let destroy callbacks adjust ext mem size (2026-08-10 20:28:25 +0200)

----------------------------------------------------------------
netfilter pull request 26-08-10

----------------------------------------------------------------
Alexey Velichayshiy (1):
      netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Florian Westphal (3):
      netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
      netfilter: ipset: fix list type element drift bug
      netfilter: ipset: let destroy callbacks adjust ext mem size

Julian Anastasov (3):
      ipvs: add totalconns for dest
      ipvs: properly update the overload flag on dest edit
      ipvs: revalidate ihl to prevent out-of-bounds access

Jérémy Jean (1):
      netfilter: flowtable: publish GC-visible tuple last

Kyle Zeng (1):
      ipvs: clear IPv4 options after rebasing tunnel ICMP errors

Xiang Mei (Microsoft) (1):
      netfilter: ipset: fix refcount race between list:set GC and swap

Yizhou Zhao (1):
      ipvs: separate destination availability state

Zhiling Zou (1):
      netfilter: bridge: release template ct on non-IP path

Zihan Xi (1):
      netfilter: nf_conntrack: defer invalid log until after unlock

 include/net/ip_vs.h                        |  29 +++++--
 include/uapi/linux/ip_vs.h                 |   6 --
 net/bridge/netfilter/nf_conntrack_bridge.c |   1 +
 net/netfilter/ipset/ip_set_bitmap_gen.h    |   2 +-
 net/netfilter/ipset/ip_set_core.c          |  19 +++--
 net/netfilter/ipset/ip_set_list_set.c      |  10 ++-
 net/netfilter/ipvs/ip_vs_conn.c            |  45 +++-------
 net/netfilter/ipvs/ip_vs_core.c            |  18 ++--
 net/netfilter/ipvs/ip_vs_ctl.c             |  81 ++++++++++++++----
 net/netfilter/ipvs/ip_vs_dh.c              |   4 +-
 net/netfilter/ipvs/ip_vs_lblc.c            |   2 +-
 net/netfilter/ipvs/ip_vs_lblcr.c           |   8 +-
 net/netfilter/ipvs/ip_vs_lc.c              |   4 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c      |   2 -
 net/netfilter/ipvs/ip_vs_proto_tcp.c       |   2 -
 net/netfilter/ipvs/ip_vs_sync.c            |   7 +-
 net/netfilter/ipvs/ip_vs_xmit.c            |   7 +-
 net/netfilter/nf_conntrack_proto.c         |   6 ++
 net/netfilter/nf_conntrack_proto_sctp.c    |  12 ++-
 net/netfilter/nf_conntrack_proto_tcp.c     | 132 +++++++++++++++++++----------
 net/netfilter/nf_flow_table_core.c         |   7 +-
 net/netfilter/nf_log_syslog.c              |   4 +-
 net/netfilter/nf_tables_offload.c          |   2 +-
 net/netfilter/nfnetlink_log.c              |  13 ++-
 24 files changed, 270 insertions(+), 153 deletions(-)