* [PATCH net 1/6] netfilter: nft_set_pipapo: fix range overlap detection
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-04 20:13 ` patchwork-bot+netdevbpf
2026-01-02 11:41 ` [PATCH net 2/6] selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug Florian Westphal
` (5 subsequent siblings)
6 siblings, 1 reply; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
set->klen has to be used, not sizeof(). The latter only compares a
single register but a full check of the entire key is needed.
Example:
table ip t {
map s {
typeof iifname . ip saddr : verdict
flags interval
}
}
nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
nft add element t s '{ "lo" . 10.0.0.0/8 : drop }' # bug: no error
The 3rd 'add element' should be rejected via -ENOTEMPTY, not -EEXIST,
so userspace / nft can report an error to the user.
The latter is only correct for the 2nd case (re-add of existing element).
As-is, userspace is told that the command was successful, but no elements were
added.
After this patch, 3rd command gives:
Error: Could not process rule: File exists
add element t s { "lo" . 127.0.0.0/8 . "lo" : drop }
^^^^^^^^^^^^^^^^^^^^^^^^^
Fixes: 0eb4b5ee33f2 ("netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nft_set_pipapo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 112fe46788b6..6d77a5f0088a 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1317,8 +1317,8 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
else
dup_end = dup_key;
- if (!memcmp(start, dup_key->data, sizeof(*dup_key->data)) &&
- !memcmp(end, dup_end->data, sizeof(*dup_end->data))) {
+ if (!memcmp(start, dup_key->data, set->klen) &&
+ !memcmp(end, dup_end->data, set->klen)) {
*elem_priv = &dup->priv;
return -EEXIST;
}
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH net 1/6] netfilter: nft_set_pipapo: fix range overlap detection
2026-01-02 11:41 ` [PATCH net 1/6] netfilter: nft_set_pipapo: fix range overlap detection Florian Westphal
@ 2026-01-04 20:13 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 10+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-01-04 20:13 UTC (permalink / raw)
To: Florian Westphal
Cc: netdev, pabeni, davem, edumazet, kuba, netfilter-devel, pablo
Hello:
This series was applied to netdev/net.git (main)
by Florian Westphal <fw@strlen.de>:
On Fri, 2 Jan 2026 12:41:23 +0100 you wrote:
> set->klen has to be used, not sizeof(). The latter only compares a
> single register but a full check of the entire key is needed.
>
> Example:
> table ip t {
> map s {
> typeof iifname . ip saddr : verdict
> flags interval
> }
> }
>
> [...]
Here is the summary with links:
- [net,1/6] netfilter: nft_set_pipapo: fix range overlap detection
https://git.kernel.org/netdev/net/c/7711f4bb4b36
- [net,2/6] selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug
https://git.kernel.org/netdev/net/c/a675d1caa204
- [net,3/6] netfilter: nft_synproxy: avoid possible data-race on update operation
https://git.kernel.org/netdev/net/c/36a320057564
- [net,4/6] netfilter: replace -EEXIST with -EBUSY
https://git.kernel.org/netdev/net/c/2bafeb8d2f38
- [net,5/6] netfilter: nf_tables: fix memory leak in nf_tables_newrule()
https://git.kernel.org/netdev/net/c/d077e8119ddb
- [net,6/6] netfilter: nf_conncount: update last_gc only when GC has been performed
https://git.kernel.org/netdev/net/c/7811ba452402
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH net 2/6] selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
2026-01-02 11:41 ` [PATCH net 1/6] netfilter: nft_set_pipapo: fix range overlap detection Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-02 11:41 ` [PATCH net 3/6] netfilter: nft_synproxy: avoid possible data-race on update operation Florian Westphal
` (4 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
without 'netfilter: nft_set_pipapo: fix range overlap detection':
reject overlapping range on add 0s [FAIL]
Returned success for add { 1.2.3.4 . 1.2.4.1-1.2.4.2 } given set:
table inet filter {
[..]
elements = { 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0,
1.2.3.0-1.2.3.4 . 1.2.4.2 counter packets 0 bytes 0 }
}
The element collides with existing ones and was not added, but kernel
returned success to userspace.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
.../net/netfilter/nft_concat_range.sh | 45 ++++++++++++++++++-
1 file changed, 44 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/netfilter/nft_concat_range.sh b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
index ad97c6227f35..394166f224a4 100755
--- a/tools/testing/selftests/net/netfilter/nft_concat_range.sh
+++ b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
@@ -29,7 +29,7 @@ TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto
net6_port_net6_port net_port_mac_proto_net"
# Reported bugs, also described by TYPE_ variables below
-BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch doublecreate"
+BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch doublecreate insert_overlap"
# List of possible paths to pktgen script from kernel tree for performance tests
PKTGEN_SCRIPT_PATHS="
@@ -420,6 +420,18 @@ race_repeat 0
perf_duration 0
"
+TYPE_insert_overlap="
+display reject overlapping range on add
+type_spec ipv4_addr . ipv4_addr
+chain_spec ip saddr . ip daddr
+dst addr4
+proto icmp
+
+race_repeat 0
+
+perf_duration 0
+"
+
# Set template for all tests, types and rules are filled in depending on test
set_template='
flush ruleset
@@ -1954,6 +1966,37 @@ EOF
return 0
}
+add_fail()
+{
+ if nft add element inet filter test "$1" 2>/dev/null ; then
+ err "Returned success for add ${1} given set:"
+ err "$(nft -a list set inet filter test )"
+ return 1
+ fi
+
+ return 0
+}
+
+test_bug_insert_overlap()
+{
+ local elements="1.2.3.4 . 1.2.4.1"
+
+ setup veth send_"${proto}" set || return ${ksft_skip}
+
+ add "{ $elements }" || return 1
+
+ elements="1.2.3.0-1.2.3.4 . 1.2.4.1"
+ add_fail "{ $elements }" || return 1
+
+ elements="1.2.3.0-1.2.3.4 . 1.2.4.2"
+ add "{ $elements }" || return 1
+
+ elements="1.2.3.4 . 1.2.4.1-1.2.4.2"
+ add_fail "{ $elements }" || return 1
+
+ return 0
+}
+
test_reported_issues() {
eval test_bug_"${subtest}"
}
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH net 3/6] netfilter: nft_synproxy: avoid possible data-race on update operation
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
2026-01-02 11:41 ` [PATCH net 1/6] netfilter: nft_set_pipapo: fix range overlap detection Florian Westphal
2026-01-02 11:41 ` [PATCH net 2/6] selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-02 11:41 ` [PATCH net 4/6] netfilter: replace -EEXIST with -EBUSY Florian Westphal
` (3 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
From: Fernando Fernandez Mancera <fmancera@suse.de>
During nft_synproxy eval we are reading nf_synproxy_info struct which
can be modified on update operation concurrently. As nf_synproxy_info
struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nft_synproxy.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 5d3e51825985..4d3e5a31b412 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
struct tcphdr *_tcph,
struct synproxy_options *opts)
{
- struct nf_synproxy_info info = priv->info;
+ struct nf_synproxy_info info = READ_ONCE(priv->info);
struct net *net = nft_net(pkt);
struct synproxy_net *snet = synproxy_pernet(net);
struct sk_buff *skb = pkt->skb;
@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
struct tcphdr *_tcph,
struct synproxy_options *opts)
{
- struct nf_synproxy_info info = priv->info;
+ struct nf_synproxy_info info = READ_ONCE(priv->info);
struct net *net = nft_net(pkt);
struct synproxy_net *snet = synproxy_pernet(net);
struct sk_buff *skb = pkt->skb;
@@ -340,7 +340,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
struct nft_synproxy *newpriv = nft_obj_data(newobj);
struct nft_synproxy *priv = nft_obj_data(obj);
- priv->info = newpriv->info;
+ WRITE_ONCE(priv->info, newpriv->info);
}
static struct nft_object_type nft_synproxy_obj_type;
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH net 4/6] netfilter: replace -EEXIST with -EBUSY
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
` (2 preceding siblings ...)
2026-01-02 11:41 ` [PATCH net 3/6] netfilter: nft_synproxy: avoid possible data-race on update operation Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-02 11:41 ` [PATCH net 5/6] netfilter: nf_tables: fix memory leak in nf_tables_newrule() Florian Westphal
` (2 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
From: Daniel Gomez <da.gomez@samsung.com>
The -EEXIST error code is reserved by the module loading infrastructure
to indicate that a module is already loaded. When a module's init
function returns -EEXIST, userspace tools like kmod interpret this as
"module already loaded" and treat the operation as successful, returning
0 to the user even though the module initialization actually failed.
Replace -EEXIST with -EBUSY to ensure correct error reporting in the module
initialization path.
Affected modules:
* ebtable_broute ebtable_filter ebtable_nat arptable_filter
* ip6table_filter ip6table_mangle ip6table_nat ip6table_raw
* ip6table_security iptable_filter iptable_mangle iptable_nat
* iptable_raw iptable_security
Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/bridge/netfilter/ebtables.c | 2 +-
net/netfilter/nf_log.c | 4 ++--
net/netfilter/x_tables.c | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5697e3949a36..a04fc1757528 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1299,7 +1299,7 @@ int ebt_register_template(const struct ebt_table *t, int (*table_init)(struct ne
list_for_each_entry(tmpl, &template_tables, list) {
if (WARN_ON_ONCE(strcmp(t->name, tmpl->name) == 0)) {
mutex_unlock(&ebt_mutex);
- return -EEXIST;
+ return -EBUSY;
}
}
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 74cef8bf554c..62cf6a30875e 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -89,7 +89,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
if (pf == NFPROTO_UNSPEC) {
for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
if (rcu_access_pointer(loggers[i][logger->type])) {
- ret = -EEXIST;
+ ret = -EBUSY;
goto unlock;
}
}
@@ -97,7 +97,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
rcu_assign_pointer(loggers[i][logger->type], logger);
} else {
if (rcu_access_pointer(loggers[pf][logger->type])) {
- ret = -EEXIST;
+ ret = -EBUSY;
goto unlock;
}
rcu_assign_pointer(loggers[pf][logger->type], logger);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 90b7630421c4..48105ea3df15 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1764,7 +1764,7 @@ EXPORT_SYMBOL_GPL(xt_hook_ops_alloc);
int xt_register_template(const struct xt_table *table,
int (*table_init)(struct net *net))
{
- int ret = -EEXIST, af = table->af;
+ int ret = -EBUSY, af = table->af;
struct xt_template *t;
mutex_lock(&xt[af].mutex);
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH net 5/6] netfilter: nf_tables: fix memory leak in nf_tables_newrule()
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
` (3 preceding siblings ...)
2026-01-02 11:41 ` [PATCH net 4/6] netfilter: replace -EEXIST with -EBUSY Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-02 11:41 ` [PATCH net 6/6] netfilter: nf_conncount: update last_gc only when GC has been performed Florian Westphal
2026-01-04 15:08 ` [PATCH net 0/6] netfilter: updates for net Fernando Fernandez Mancera
6 siblings, 0 replies; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
From: Zilin Guan <zilin@seu.edu.cn>
In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
the err_release_rule label without freeing the allocated flow, leading
to a memory leak.
Fix this by adding a new label err_destroy_flow and jumping to it when
nft_use_inc() fails. This ensures that the flow is properly released
in this error case.
Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nf_tables_api.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 618af6e90773..729a92781a1a 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4439,7 +4439,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (!nft_use_inc(&chain->use)) {
err = -EMFILE;
- goto err_release_rule;
+ goto err_destroy_flow;
}
if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
@@ -4489,6 +4489,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
err_destroy_flow_rule:
nft_use_dec_restore(&chain->use);
+err_destroy_flow:
if (flow)
nft_flow_rule_destroy(flow);
err_release_rule:
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH net 6/6] netfilter: nf_conncount: update last_gc only when GC has been performed
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
` (4 preceding siblings ...)
2026-01-02 11:41 ` [PATCH net 5/6] netfilter: nf_tables: fix memory leak in nf_tables_newrule() Florian Westphal
@ 2026-01-02 11:41 ` Florian Westphal
2026-01-04 15:08 ` [PATCH net 0/6] netfilter: updates for net Fernando Fernandez Mancera
6 siblings, 0 replies; 10+ messages in thread
From: Florian Westphal @ 2026-01-02 11:41 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
From: Fernando Fernandez Mancera <fmancera@suse.de>
Currently last_gc is being updated everytime a new connection is
tracked, that means that it is updated even if a GC wasn't performed.
With a sufficiently high packet rate, it is possible to always bypass
the GC, causing the list to grow infinitely.
Update the last_gc value only when a GC has been actually performed.
Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nf_conncount.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 3654f1e8976c..8487808c8761 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
nf_ct_put(found_ct);
}
+ list->last_gc = (u32)jiffies;
add_new_node:
if (WARN_ON_ONCE(list->count > INT_MAX)) {
@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
conn->jiffies32 = (u32)jiffies;
list_add_tail(&conn->node, &list->head);
list->count++;
- list->last_gc = (u32)jiffies;
out_put:
if (refcounted)
--
2.51.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH net 0/6] netfilter: updates for net
2026-01-02 11:41 [PATCH net 0/6] netfilter: updates for net Florian Westphal
` (5 preceding siblings ...)
2026-01-02 11:41 ` [PATCH net 6/6] netfilter: nf_conncount: update last_gc only when GC has been performed Florian Westphal
@ 2026-01-04 15:08 ` Fernando Fernandez Mancera
2026-01-04 15:16 ` Florian Westphal
6 siblings, 1 reply; 10+ messages in thread
From: Fernando Fernandez Mancera @ 2026-01-04 15:08 UTC (permalink / raw)
To: Florian Westphal, netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
On 1/2/26 12:41 PM, Florian Westphal wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for *net*:
>
> 1) Fix overlap detection for nf_tables with concatenated ranges.
> There are cases where element could not be added due to a conflict
> with existing range, while kernel reports success to userspace.
> 2) update selftest to cover this bug.
> 3) synproxy update path should use READ/WRITE once as we replace
> config struct while packet path might read it in parallel.
> This relies on said config struct to fit sizeof(long).
> From Fernando Fernandez Mancera.
> 4) Don't return -EEXIST from xtables in module load path, a pending
> patch to module infra will spot a warning if this happens.
> From Daniel Gomez.
> 5) Fix a memory leak in nf_tables when chain hits 2**32 users
> and rule is to be hw-offloaded, from Zilin Guan.
> 6) Avoid infinite list growth when insert rate is high in nf_conncount,
> also from Fernando.
Hi Florian,
FWIW, infinite list growth is still possible when insert rate is high in
nf_conncount as I noticed that the commit "netfilter: nf_conncount:
increase the connection clean up limit to 64" was not included in the
pull request.
It is not a big deal. I am fine delaying the fix but just wanted to clarify.
Thanks,
Fernando.
> Please, pull these changes from:
> The following changes since commit dbf8fe85a16a33d6b6bd01f2bc606fc017771465:
>
> Merge tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2025-12-30 08:45:58 -0800)
>
> are available in the Git repository at:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-01-02
>
> for you to fetch changes up to 7811ba452402d58628e68faedf38745b3d485e3c:
>
> netfilter: nf_conncount: update last_gc only when GC has been performed (2026-01-02 10:44:28 +0100)
>
> ----------------------------------------------------------------
> netfilter pull request nf-26-01-02
>
> ----------------------------------------------------------------
> Daniel Gomez (1):
> netfilter: replace -EEXIST with -EBUSY
>
> Fernando Fernandez Mancera (2):
> netfilter: nft_synproxy: avoid possible data-race on update operation
> netfilter: nf_conncount: update last_gc only when GC has been performed
>
> Florian Westphal (2):
> netfilter: nft_set_pipapo: fix range overlap detection
> selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug
>
> Zilin Guan (1):
> netfilter: nf_tables: fix memory leak in nf_tables_newrule()
>
> net/bridge/netfilter/ebtables.c | 2 +-
> net/netfilter/nf_conncount.c | 2 +-
> net/netfilter/nf_log.c | 4 +-
> net/netfilter/nf_tables_api.c | 3 +-
> net/netfilter/nft_set_pipapo.c | 4 +-
> net/netfilter/nft_synproxy.c | 6 +--
> net/netfilter/x_tables.c | 2 +-
> .../selftests/net/netfilter/nft_concat_range.sh | 45 +++++++++++++++++++++-
> 8 files changed, 56 insertions(+), 12 deletions(-)
> # WARNING: 0000-cover-letter.patch lacks signed-off-by tag!
> # WARNING: skip 0000-cover-letter.patch, no "Fixes" tag!
> # INFO: 0001-netfilter-nft_set_pipapo-fix-range-overlap-detection.patch fixes commit from v5.6~21^2~5^2~5
> # WARNING: skip 0002-selftests-netfilter-nft_concat_range.sh-add-check-fo.patch, no "Fixes" tag!
> # INFO: 0003-netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch fixes commit from v5.4-rc1~131^2~26^2~23
> # WARNING: skip 0004-netfilter-replace-EEXIST-with-EBUSY.patch, no "Fixes" tag!
> # INFO: 0005-netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch fixes commit from v6.5-rc2~22^2~39^2~5
> # INFO: 0006-netfilter-nf_conncount-update-last_gc-only-when-GC-h.patch fixes commit from v5.19-rc1~159^2~45^2~2
>
^ permalink raw reply [flat|nested] 10+ messages in thread