[PATCH net 00/10] netfilter: updates for net

[Florian Westphal <fw@strlen.de>]

Hi,

The following patchset contains Netfilter fixes for *net*:

1) Add missing __rcu annotations to NAT helper hook pointers in Amanda, FTP,
   IRC, SNMP and TFTP helpers.  From Sun Jian.

2-4):
 - Add global spinlock to serialize nft_counter fetch+reset operations.
 - Use atomic64_xchg() for nft_quota reset instead of read+subtract pattern.
   Note AI review detects a race in this change but it isn't new. The
   'racing' bit only exists to prevent constant stream of 'quota expired'
   notifications.
 - Revert commit_mutex usage in nf_tables reset path, it caused
   circular lock dependency.  All from Brian Witte.

5) Fix uninitialized l3num value in nf_conntrack_h323 helper.

6) Fix musl libc compatibility in netfilter_bridge.h UAPI header. This
   change isn't nice (UAPI headers should not include libc headers), but
   as-is musl builds may fail due to redefinition of struct ethhdr.

7) Fix protocol checksum validation in IPVS for IPv6 with extension headers,
   from Julian Anastasov.

8) Fix device reference leak in IPVS when netdev goes down. Also from
   Julian.

9) Remove WARN_ON_ONCE when accessing forward path array, this can
   trigger with sufficiently long forward paths.  From Pablo Neira Ayuso.

10) Fix use-after-free in nf_tables_addchain() error path, from Inseo An.

Please, pull these changes from:
The following changes since commit 77c5e3fdd2793f478e6fdae55c9ea85b21d06f8f:

  Merge branch 'selftests-forwarding-fix-br_netfilter-related-test-failures' (2026-02-17 13:34:41 +0100)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-02-17

for you to fetch changes up to 71e99ee20fc3f662555118cf1159443250647533:

  netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (2026-02-17 15:04:20 +0100)

----------------------------------------------------------------
netfilter pull request nf-26-02-17

----------------------------------------------------------------
Brian Witte (3):
  netfilter: nft_counter: serialize reset with spinlock
  netfilter: nft_quota: use atomic64_xchg for reset
  netfilter: nf_tables: revert commit_mutex usage in reset path

Florian Westphal (1):
  netfilter: nf_conntrack_h323: don't pass uninitialised l3num value

Inseo An (1):
  netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

Julian Anastasov (2):
  ipvs: skip ipv6 extension headers for csum checks
  ipvs: do not keep dest_dst if dev is going down

Pablo Neira Ayuso (1):
  net: remove WARN_ON_ONCE when accessing forward path array

Phil Sutter (1):
  include: uapi: netfilter_bridge.h: Cover for musl libc

Sun Jian (1):
  netfilter: annotate NAT helper hook pointers with __rcu

 include/linux/netfilter/nf_conntrack_amanda.h |   2 +-
 include/linux/netfilter/nf_conntrack_ftp.h    |   2 +-
 include/linux/netfilter/nf_conntrack_irc.h    |   2 +-
 include/linux/netfilter/nf_conntrack_snmp.h   |   2 +-
 include/linux/netfilter/nf_conntrack_tftp.h   |   2 +-
 include/uapi/linux/netfilter_bridge.h         |   4 +
 net/core/dev.c                                |   2 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c         |  18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c          |  21 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c          |  20 +-
 net/netfilter/ipvs/ip_vs_xmit.c               |  46 +++-
 net/netfilter/nf_conntrack_amanda.c           |  14 +-
 net/netfilter/nf_conntrack_ftp.c              |  14 +-
 net/netfilter/nf_conntrack_h323_main.c        |  10 +-
 net/netfilter/nf_conntrack_irc.c              |  13 +-
 net/netfilter/nf_conntrack_snmp.c             |   8 +-
 net/netfilter/nf_conntrack_tftp.c             |   7 +-
 net/netfilter/nf_tables_api.c                 | 249 +++---------------
 net/netfilter/nft_counter.c                   |  20 +-
 net/netfilter/nft_quota.c                     |  13 +-
 20 files changed, 166 insertions(+), 303 deletions(-)

-- 
2.52.0