[PATCH net,v2 0/9] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

v2: Keep back all the patches that Jakub's LLMs are complaining
    about.

-o-

The following patchset contains Netfilter/IPVS fixes for net:
 
1) Reject malformed messages in IPVS sync, from Kyle Zeng.
 
2) Fix possible stale infoleak in IPVS sync, also from Kyle Zeng.
 
3) Out-of-bound read in the SIP conntrack helper, from
   Joas Antonio dos Santos.
 
4) UaF on cttimeout module removal, from Chengfeng Ye.
 
5) Unregister nf_loggers before netns teardown to fix UaF,
   also from Chengfeng Ye.
 
6) Fix race in nfnetlink_log due to concurrent instance destruction,
   from Florian Westphal.
 
7) Remove arp_table 32bit compat interface, this is already off in
    many distributions, from Florian Westphal.
 
8) Set IP6T_F_PROTO flag is e->ipv6.proto is set on to deal with
    insufficient validation of xtables extensions when used from
    legacy ip6tables, from Florian.
 
9) Set on the NLM_F_DUMP_FILTERED flag when all is filtering out
   in ctnetlink, from Ilya Maximets.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-07

Thanks.

----------------------------------------------------------------

The following changes since commit 1d2929d0850fff683b8aff051275945e65f082c8:

  net: psp: do not inherit the Rx association on clone (2026-09-01 15:12:24 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-07

for you to fetch changes up to 7a099b347fef536a84068076e2d384f044e5cfc5:

  netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (2026-09-07 18:48:56 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-07

----------------------------------------------------------------
Chengfeng Ye (2):
      netfilter: cttimeout: prevent UAF during module unload
      netfilter: nf_log: unregister loggers before per-net teardown

Florian Westphal (3):
      netfilter: nfnetlink_log: cope with concurrent instance destruction
      netfilter: arp_tables: remove the 32bit compat interface
      netfilter: ip6_tables: set F_PROTO when proto value is nonzero

Ilya Maximets (1):
      netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

Joas Antonio dos Santos (1):
      netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Kyle Zeng (2):
      ipvs: reject invalid states in connection template sync records
      ipvs: fix reversed sequence option serialization

 include/linux/netfilter_arp/arp_tables.h |  19 --
 net/ipv4/netfilter/arp_tables.c          | 472 +------------------------------
 net/ipv6/netfilter/ip6_tables.c          |   5 +
 net/netfilter/Kconfig                    |   2 +-
 net/netfilter/ipvs/ip_vs_sync.c          |  20 +-
 net/netfilter/nf_conntrack_netlink.c     |   2 +
 net/netfilter/nf_conntrack_sip.c         |   2 +-
 net/netfilter/nf_log_syslog.c            |   2 +-
 net/netfilter/nfnetlink_cttimeout.c      |   2 +-
 net/netfilter/nfnetlink_log.c            |  15 +-
 10 files changed, 34 insertions(+), 507 deletions(-)