[PATCH net,v2 0/8] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

v2: - keep back IPVS patch
      "ipvs: filter some flags received in the backup server"
      so Julian has a change to revisit the commit description.
    - Add check for dead bit in nf_tables catchall patch.

-o-

Hi,

The following patchset contains Netfilter/IPVS fixes for net, they are:

1) Set on HW_DEAD after HW_PENDING is cleared in the flowtable offload
   to ensure GC does not zap it, from Jérémy Jean.
 
2) Hold the nfnetlink_queue mutex while removing the queue instance
   from the netlink notifier that handles NETLINK_URELEASE to fix a
   possible race with the UNBIND command. From Florian Westphal.
 
3) Reject route with NULL rt6i_idev in ip6t_rpfilter. From Weiming Shi.
 
4) Reject rtinfo->addrnr set to zero from ip6t_rt .checkentry path.
   This also fortifies the datapath loop as per Florian's request.
   From Luxiao Xu.
 
5) Fix checksuming in nft_synproxy for IPv6, from Karl Mehltretter.
 
6) Revalidate ihl before calling icmp_send() in IPVS,
   from Julian Anastasov.
 
7) Fix suspicious RCU usage splat in ctnetlink with expectations.
 
8) Check for expired catchall elements in the insert and deactivate
   path. From Aohan Mei.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-18

Thanks.

----------------------------------------------------------------

The following changes since commit 3b95a04eb5f95bf6a016a1bb9ff37d3eee48de63:

  Merge branch 'mptcp-misc-fixes-for-v7-3-rc4' (2026-09-17 08:14:39 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-18

for you to fetch changes up to 70194dc37670bd08e44b471389861cc01bd3a3c9:

  netfilter: nf_tables: skip expired catchall elements on insert and delete (2026-09-18 11:24:05 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-18

----------------------------------------------------------------
Aohan Mei (1):
      netfilter: nf_tables: skip expired catchall elements on insert and delete

Florian Westphal (1):
      netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

Julian Anastasov (1):
      ipvs: revalidate ihl before icmp_send

Jérémy Jean (1):
      netfilter: flowtable: publish HW_DEAD after worker is done

Karl Mehltretter (1):
      netfilter: nft_synproxy: use the family-aware checksum helper

Luxiao Xu (1):
      netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

Naman Gulati (1):
      netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name

Weiming Shi (1):
      netfilter: ip6t_rpfilter: reject routes without inet6_dev

 net/ipv6/netfilter/ip6t_rpfilter.c    |  2 +-
 net/ipv6/netfilter/ip6t_rt.c          | 11 ++++++++---
 net/netfilter/ipvs/ip_vs_core.c       |  6 ++++++
 net/netfilter/nf_conntrack_netlink.c  |  3 ++-
 net/netfilter/nf_flow_table_offload.c |  7 ++++++-
 net/netfilter/nf_tables_api.c         | 10 ++++++++--
 net/netfilter/nfnetlink_queue.c       |  8 +++++---
 net/netfilter/nft_synproxy.c          |  3 ++-
 8 files changed, 38 insertions(+), 12 deletions(-)