Re: [PATCH net 00/15] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Nov 03, 2026 at 01:27:30PM +0100, Matthieu Baerts wrote:
> Hi Paolo, Pablo,
> 
> On 03/11/2026 13:04, Paolo Abeni wrote:
> > On 11/2/26 01:56, Pablo Neira Ayuso wrote:
> >> Hi,
> >>
> >> The following batch contains Netfilter/IPVS fixes for net:
> >>
> >> 1) Add recursion count to nf_reject infrastructure to prevent stack
> >>     overflow, from Fernando F. Mancera.
> >>
> >> 2) Address a infinite loop in RCU list traversal with the TWOS IPVS
> >>     scheduler, from Darong Lu and Julian Anastasov.
> >>
> >> 3) Use kfree_rcu() to release IPVS parent application to fix UaF,
> >>     from Chengfeng Ye.
> >>
> >> 4) Fix UaF in IPVS netns removal path due to releasing per-net protocol
> >>     data too early, from Chengfeng Ye.
> >>
> >> 5) Fix unbounded growth of stale, unmatchable IPVS connection entries,
> >>     from Julian Anastasov.
> >>
> >> 6) Restrict maximum master conntrack chain depth in ctnetlink,
> >>     from Florian Westphal.
> >>
> >> 7) Preserve recursion count on nfqueue reinjection, from Zihan Xi.
> >>
> >> 8) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
> >>     is reachable, from Michail Andreas Michalopoulos.
> >>
> >> 9) Check non-null gc transaction in nft_rbtree before queuing it for
> >>     processing, from Xingyuan Mo.
> >>
> >> 10) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
> >>      nf_conntrack_bridge which is reachable if the protocol of the tag
> >>      of a frame differs from the vlan_protocol of the bridge.
> >>      From Laveesh Bansal.
> >>
> >> 11) Check x_tables target name is non-null before accessing it when
> >>      building a new table, from Fernando F. Mancera.
> >>
> >> 12) Fix out-of-bound memory read in nf_conntrack_sip, from
> >>      Joas Antonio Dos Santos.
> >>
> >> 13) Fix a memleak in nf_tables hardware offload when double deleting
> >>      the same rule, in the same batch.
> >>
> >> 14) Use a mutex in xt_recent netns exit path instead of spinlock,
> >>      since proc unregistration might sleep. From Cen Zhang.
> >>
> >> 15) Zero the nf_nat_range2 struct before filling it up, to avoid
> >>      using stale uninitialized stack data to configure NAT with
> >>      an esoteric NAT flags combination. From Florian Westphal.
> >>
> >> Please, pull these changes from:
> >>
> >>    git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
> >> nf-26-11-02
> > I'm sorry, but something went very wrong on the nipa side: the tools did
> > not pick this PR. Do you mind repost it verbatim?
> 
> It looks like the patches have not been tested, because of the kdoc
> issue on patch 6/15:
> 
> https://netdev-ctrl.bots.linux.dev/logview.html?f=/logs/build/1198360/14931104/kdoc/stdout

I routinely run checkpath.pl, I will re-check what happened here.