Re: [PATCH net 01/11] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to netdev/net.git (main)
by Florian Westphal <fw@strlen.de>:

On Fri, 13 Mar 2026 16:06:04 +0100 you wrote:
> From: Hyunwoo Kim <imv4bel@gmail.com>
> 
> ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the
> netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the
> conntrack reference immediately after netlink_dump_start().  When the
> dump spans multiple rounds, the second recvmsg() triggers the dump
> callback which dereferences the now-freed conntrack via nfct_help(ct),
> leading to a use-after-free on ct->ext.
> 
> [...]

Here is the summary with links:
  - [net,01/11] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
    https://git.kernel.org/netdev/net/c/5cb81eeda909
  - [net,02/11] netfilter: conntrack: add missing netlink policy validations
    https://git.kernel.org/netdev/net/c/f900e1d77ee0
  - [net,03/11] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
    https://git.kernel.org/netdev/net/c/fbce58e719a1
  - [net,04/11] netfilter: revert nft_set_rbtree: validate open interval overlap
    https://git.kernel.org/netdev/net/c/598adea720b9
  - [net,05/11] netfilter: nf_flow_table_ip: reset mac header before vlan push
    https://git.kernel.org/netdev/net/c/a3aca98aec9a
  - [net,06/11] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
    https://git.kernel.org/netdev/net/c/1e3a3593162c
  - [net,07/11] nf_tables: nft_dynset: fix possible stateful expression memleak in error path
    https://git.kernel.org/netdev/net/c/0548a13b5a14
  - [net,08/11] netfilter: nft_ct: drop pending enqueued packets on removal
    https://git.kernel.org/netdev/net/c/36eae0956f65
  - [net,09/11] netfilter: xt_CT: drop pending enqueued packets on template removal
    https://git.kernel.org/netdev/net/c/f62a218a946b
  - [net,10/11] netfilter: xt_time: use unsigned int for monthday bit shift
    https://git.kernel.org/netdev/net/c/00050ec08cec
  - [net,11/11] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
    https://git.kernel.org/netdev/net/c/f173d0f4c0f6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html