[PATCH net 00/11] netfilter: updates for net

[Florian Westphal <fw@strlen.de>]

Hi,

This is a much earlier pull request than usual, due to the large
backlog.  We are aware of several unfixed issues, in particular in
ctnetlink, patches are being worked on.

The following patchset contains Netfilter fixes for *net*:

1) fix a use-after-free in ctnetlink, from Hyunwoo Kim, broken
   since v3.10.
2) add missing netlink range checks in ctnetlink, broken since v2.6
   days.
3) fix content length truncation in sip conntrack helper,
   from Lukas Johannes Möller.  Broken since 2.6.34.
4) Revert a recent patch to add stronger checks for overlapping ranges
   in nf_tables rbtree set type.
   Patch is correct, but several nftables version have a bug (now fixed)
   that trigger the checks incorrectly.
5) Reset mac header before the vlan push to avoid warning splat (and
   make things functional). From Eric Woudstra.
6) Add missing bounds check in H323 conntrack helper, broken since this
   helper was added 20 years ago, from Jenny Guanni Qu.
7) Fix a memory leak in the dynamic set infrastructure, from Pablo Neira
   Ayuso.  Broken since v5.11.
8+9) a few spots failed to purge skbs queued to userspace via nfqueue,
   this causes RCU escape / use-after-free. Also from Pablo. broken
   since v3.4 added the CT target to xtables.
10) Fix undefined behaviour in xt_time, use u32 for a shift-by-31
    operation, not s32, from Jenny Guanni Qu.
11) H323 conntrack helper lacks a check for length variable becoming
    negative after decrement, causes major out-of-bounds read due to
    cast to unsigned size later, also from Jenny.
    Both issues exist since 2.6 days.

Please, pull these changes from:
The following changes since commit 99600f79b28c83c68bae199a3d8e95049a758308:

  mpls: add missing unregister_netdevice_notifier to mpls_init (2026-03-12 19:25:59 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-03-13

for you to fetch changes up to f173d0f4c0f689173f8cdac79991043a4a89bf66:

  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (2026-03-13 15:31:15 +0100)

----------------------------------------------------------------
netfilter pull request nf-26-03-13

----------------------------------------------------------------
Eric Woudstra (1):
      netfilter: nf_flow_table_ip: reset mac header before vlan push

Florian Westphal (2):
      netfilter: conntrack: add missing netlink policy validations
      netfilter: revert nft_set_rbtree: validate open interval overlap

Hyunwoo Kim (1):
      netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()

Jenny Guanni Qu (3):
      netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
      netfilter: xt_time: use unsigned int for monthday bit shift
      netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

Lukas Johannes Möller (1):
      netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()

Pablo Neira Ayuso (3):
      nf_tables: nft_dynset: fix possible stateful expression memleak in error path
      netfilter: nft_ct: drop pending enqueued packets on removal
      netfilter: xt_CT: drop pending enqueued packets on template removal

 include/net/netfilter/nf_tables.h       |  6 +--
 net/netfilter/nf_conntrack_h323_asn1.c  |  4 ++
 net/netfilter/nf_conntrack_netlink.c    | 28 +++++++++-
 net/netfilter/nf_conntrack_proto_sctp.c |  3 +-
 net/netfilter/nf_conntrack_sip.c        |  6 ++-
 net/netfilter/nf_flow_table_ip.c        |  1 +
 net/netfilter/nf_tables_api.c           | 25 +++------
 net/netfilter/nft_ct.c                  |  4 ++
 net/netfilter/nft_dynset.c              | 10 +++-
 net/netfilter/nft_set_rbtree.c          | 71 ++++---------------------
 net/netfilter/xt_CT.c                   |  4 ++
 net/netfilter/xt_time.c                 |  4 +-
 12 files changed, 75 insertions(+), 91 deletions(-)
-- 
2.52.0