[PATCH net 0/9] netfilter: updates for net

[Florian Westphal <fw@strlen.de>]

Hi,

The following patchset contains Netfilter fixes for *net*.
These are fixes for bugs except patches 6 and 9 which fix issues added in
last PR and 7.1-rc1.

1) Reject unsupported target families in xt_nat_checkentry().
From Wyatt Feng.

2) Fix inverted time_after() check in ecache_work_evict_list().
Causes pointless work rescheds and thus way longer time to
clear the pending event backlog. From Yizhou Zhao.

3) Fix a use-after-free in br_ip6_fragment() caused by a dangling prevhdr
pointer.  From Xiang Mei.

4) Fix incorrect conntrack zone comparison in nf_conncount tuple
deduplication. Pass IP_CT_DIR_ORIGINAL, not zone direction.
From Yizhou Zhao.

5) Add bridge tunnel flowtable regression test for a bug that
   got fixed in the previous PR.  From Zhengyang Chen.

6) Use the correct direction when setting up tunnel routes in the flowtable
xmit path.  From Pablo Neira Ayuso.  This fixes a bug added in the
previous PR.

7) Reload IP header after potential skb head reallocation in IPVS.

8) Fix incorrect IPv6 transport offsets in TCP application code. Correct the
ICMPv6 header offset to ensure proper checksumming with extension headers,
from Julian Anastasov.  this is a followup to the previous PR.

9) Remove null-termination requirement for xt_physdev masks, this broke
   device names with 15 characters.

Please, pull these changes from:
The following changes since commit 4fa349156043dc119721d067329714179f501749:

  net/iucv: take a reference on the socket found in afiucv_hs_rcv() (2026-07-10 16:24:43 +0200)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-07-10

for you to fetch changes up to f468c48d488d0ea2df3422b3e1dfafae1611e853:

  netfilter: xt_physdev: masks are not c-strings (2026-07-10 16:28:47 +0200)

----------------------------------------------------------------
netfilter pull request nf-26-07-10

----------------------------------------------------------------
Florian Westphal (2):
  ipvs: reload ip header after head reallocation
  netfilter: xt_physdev: masks are not c-strings

Julian Anastasov (1):
  ipvs: fix more places with wrong ipv6 transport offsets

Pablo Neira Ayuso (1):
  netfilter: flowtable: use correct direction to set up tunnel route

Wyatt Feng (1):
  netfilter: xt_nat: reject unsupported target families

Xiang Mei (Microsoft) (1):
  netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

Yizhou Zhao (2):
  netfilter: ecache: fix inverted time_after() check
  netfilter: nf_conncount: fix zone comparison in tuple dedup

Zhengyang Chen (1):
  selftests: netfilter: add bridge tunnel flowtable regression

 net/ipv6/netfilter.c                          |  4 +-
 net/netfilter/ipvs/ip_vs_app.c                | 10 ++--
 net/netfilter/ipvs/ip_vs_core.c               |  3 +-
 net/netfilter/ipvs/ip_vs_xmit.c               |  6 +-
 net/netfilter/nf_conncount.c                  |  6 +-
 net/netfilter/nf_conntrack_ecache.c           |  2 +-
 net/netfilter/nf_flow_table_core.c            |  6 +-
 net/netfilter/xt_nat.c                        |  9 +++
 net/netfilter/xt_physdev.c                    |  5 --
 .../selftests/net/netfilter/nft_flowtable.sh  | 55 +++++++++++++++++++
 10 files changed, 81 insertions(+), 25 deletions(-)

-- 
2.54.0