Re: [PATCH net-next 01/15] netfilter: flowtable: do not hw offload flows in teardown state

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Fri, Nov 13, 2026 at 03:17:05AM +0000, netdev-bot+sinfo@kernel.org wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
> 
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by LLM and not proven at runtime). If it was triggered
>    please include the symptoms, like the stack trace or kernel messages.
> 
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

This is a pull request for nf-next. It mixes fixes and new work, so
here is the information per patch:

- "flowtable: do not hw offload flows in teardown state" and
  "lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non
  init-netns": reported by Sashiko (LLM review, theoretical).

- "flowtable: retrieve stats on flow deletion" plus the mtk_ppe and
  airoha updates: reported by Valentin Berezhnoy on netfilter-devel
  (link in the Closes: tag). The last stats sync with conntrack is
  missed on hardware flow deletion.

- "flowtable: tunnel device poisons h_source of fast-path frames":
  hit in production on a DS-Lite setup (ip6tnl over PPPoE over 802.1Q
  VLAN). Every offloaded TCP/UDP flow dies because the PPPoE endpoint
  drops frames with the wrong source MAC.

- "xt_time: fix monthday computation for dates past 2039":
  theoretical. LLM keeps banging on this as an issue, so let's
  address it.

- "nft_flow_offload: do not offload multicast": this was most likely
  found in production.

- "flowtable: do not clear the offload bit twice": Found while
   developing a new driver supporting the flowtable.

- "nfnetlink_queue: make skb writable before writing NFQA_L2HDR":
   LLM finding.

- "flowtable: purge entries immediately when destroying the
  flowtable", "flowtable: do not scrub as crossing netns" and
  "flowtable: fix pmtu discovery in nf_flow_tunnel_ip6ip6_push()":
  LLM findings too.

- The two selftest patches add a test and fix a clang warning. They
  are not fixes.

Thanks.