[PATCH net,v2 0/9] Netfilter fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

v2: - Keep back patch "netfilter: nf_tables: fix device name and prefix match
      in hook lookup" needs a bit more work.
    - Address issues reported in the pr_debug() removal:
      missing \n after pr_debug() conversion, pr_fmt() in modules among other
      cosmetic issues.
    - Turn "netfilter: xt_cgroup: use pr_info_ratelimited()" into
      "netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()"
      to cover xt_hl coversion to ratelimited.
-o-

Hi,

The following patchset contains Netfilter fixes for net:
 
1) Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON() from the tproxy
   datapath, a recent bug found a way to reach WARN_ON from datapath
   due to insufficient validation of xt_TPROTO checkentry.
   From Fernando F. Mancera.
 
2) Similar to previous patch to replace WARN_ON_ONCE by
   DEBUG_NET_WARN_ON_ONCE() for connlimit. Not known issue, but
   since this patch has been around for a while, let's merge it.
   Also from Fernando.
 
3) Move nf_tables harware offload commit path after chain blob
   and audit to reduce chances of leaving the hardware in
   inconsistent state.
 
4) Add missing vzeroupper to nf_tables pipapo AVX2 to address
   performace degradation to later user of SSE code,
   from Eric Biggers.
 
5) Remove pr_debug() in x_tables extensions, a recent bogus found a
   way to print a unsanitized string in xt_IDLETIMER, many of these
   pr_debug() calls are there for historical reasons.
 
6) Use pr_info_ratelimited() in x_tables .checkentry.
 
7) Fix an imbalance in module refcount due to incorrect override
   expression logic with sets. Remove unnecessary clone in control
   plane, use the existing expressions provided by set or dynset
   expression. Release override expressions only.
 
8) Tigthen nf_tables device name removal, it is possible to remove
   prefix strings with exact device name. From Fernando F. Mancera.
 
9) Set on the set dead bit earlier, otherwise it is possible to
   call .commit on deleted sets. This also addresses the
   re-introduction of a bug.
 
Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-08-27

Thanks.

----------------------------------------------------------------

The following changes since commit 746fc0787f616da418ffc04a110296fe95d53491:

  net: usb: cdc_ncm: add Apple MacBook Pro USB product ID 0x1902 (2026-08-20 14:47:29 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-08-27

for you to fetch changes up to fc04229727d8fffbf02e0635de38413fe0102d02:

  netfilter: nf_tables: remove leftover set_update_list (2026-08-27 16:10:57 +0200)

----------------------------------------------------------------
netfilter pull request 26-08-27

----------------------------------------------------------------
Eric Biggers (1):
      netfilter: nft_set_pipapo_avx2: add missing vzeroupper

Fernando Fernandez Mancera (2):
      netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
      netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit

Pablo Neira Ayuso (6):
      netfilter: nf_tables: move hardware offload step after building the chain blob
      netfilter: x_tables: remove pr_debug
      netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
      netfilter: nf_tables: skip double clone set expressions on element insert
      netfilter: nf_tables: set on dead bit when performing early element removal
      netfilter: nf_tables: remove leftover set_update_list

 include/net/netfilter/nf_tables.h   |  2 -
 net/ipv4/netfilter/ipt_ah.c         | 10 +----
 net/ipv4/netfilter/nf_tproxy_ipv4.c |  2 +-
 net/ipv6/netfilter/ip6t_ah.c        | 27 +------------
 net/ipv6/netfilter/ip6t_frag.c      | 41 +-------------------
 net/ipv6/netfilter/ip6t_hbh.c       | 40 +++++---------------
 net/ipv6/netfilter/ip6t_mh.c        |  3 --
 net/ipv6/netfilter/ip6t_rt.c        |  6 +--
 net/ipv6/netfilter/nf_tproxy_ipv6.c |  2 +-
 net/netfilter/nf_conncount.c        |  3 +-
 net/netfilter/nf_tables_api.c       | 75 ++++++++++++++++---------------------
 net/netfilter/nft_dynset.c          | 25 ++++++++-----
 net/netfilter/nft_set_pipapo_avx2.c | 17 ++++-----
 net/netfilter/xt_IDLETIMER.c        | 68 ++++++---------------------------
 net/netfilter/xt_LOG.c              |  4 +-
 net/netfilter/xt_MASQUERADE.c       |  4 +-
 net/netfilter/xt_NETMAP.c           |  6 ++-
 net/netfilter/xt_REDIRECT.c         |  6 ++-
 net/netfilter/xt_cgroup.c           | 12 +++---
 net/netfilter/xt_esp.c              | 10 +----
 net/netfilter/xt_hl.c               |  4 +-
 net/netfilter/xt_ipcomp.c           |  8 +---
 net/netfilter/xt_iprange.c          | 32 ++--------------
 net/netfilter/xt_ipvs.c             |  1 -
 net/netfilter/xt_multiport.c        |  4 --
 net/netfilter/xt_sctp.c             | 19 +---------
 net/netfilter/xt_tcpudp.c           |  8 +---
 27 files changed, 118 insertions(+), 321 deletions(-)