[PATCH net 00/15] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following batch contains Netfilter/IPVS fixes for net:

1) Add recursion count to nf_reject infrastructure to prevent stack
   overflow, from Fernando F. Mancera.

2) Address a infinite loop in RCU list traversal with the TWOS IPVS
   scheduler, from Darong Lu and Julian Anastasov.

3) Use kfree_rcu() to release IPVS parent application to fix UaF,
   from Chengfeng Ye.

4) Fix UaF in IPVS netns removal path due to releasing per-net protocol
   data too early, from Chengfeng Ye.

5) Fix unbounded growth of stale, unmatchable IPVS connection entries,
   from Julian Anastasov.

6) Restrict maximum master conntrack chain depth in ctnetlink,
   from Florian Westphal.

7) Preserve recursion count on nfqueue reinjection, from Zihan Xi.

8) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
   is reachable, from Michail Andreas Michalopoulos.

9) Check non-null gc transaction in nft_rbtree before queuing it for
   processing, from Xingyuan Mo.

10) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
    nf_conntrack_bridge which is reachable if the protocol of the tag
    of a frame differs from the vlan_protocol of the bridge.
    From Laveesh Bansal.

11) Check x_tables target name is non-null before accessing it when
    building a new table, from Fernando F. Mancera.

12) Fix out-of-bound memory read in nf_conntrack_sip, from
    Joas Antonio Dos Santos.

13) Fix a memleak in nf_tables hardware offload when double deleting
    the same rule, in the same batch.

14) Use a mutex in xt_recent netns exit path instead of spinlock,
    since proc unregistration might sleep. From Cen Zhang.

15) Zero the nf_nat_range2 struct before filling it up, to avoid
    using stale uninitialized stack data to configure NAT with
    an esoteric NAT flags combination. From Florian Westphal.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-02

Thanks.

----------------------------------------------------------------

The following changes since commit cb284914e749388eef402938bdb3115fe1f6d337:

  net: ipa: Fix double free of the interrupt structure on config error (2026-10-30 19:04:37 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-02

for you to fetch changes up to f2cbeed50b68f547a70288e2aaa581bc6a366411:

  netfilter: nat: zero newrange before filling it in (2026-11-02 01:20:11 +0100)

----------------------------------------------------------------
netfilter pull request 26-11-02

----------------------------------------------------------------
Cen Zhang (Microsoft) (1):
      netfilter: xt_recent: do not call remove_proc_entry() under recent_lock

Chengfeng Ye (2):
      ipvs: Defer application parent freeing until after RCU readers
      ipvs: fix protocol data lifetime during namespace teardown

Darong Lu (1):
      ipvs: wait grace period while reusing dest from trash

Fernando Fernandez Mancera (2):
      netfilter: nft_reject: prevent unbounded recursion in output hooks
      netfilter: x_tables: check target name before accessing verdict

Florian Westphal (2):
      netfilter: nf_conntrack: limit expectation master chain depth
      netfilter: nat: zero newrange before filling it in

Joas Antonio dos Santos (1):
      netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

Julian Anastasov (1):
      ipvs: do not create conns from packets with port 0

Laveesh Bansal (1):
      netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag()

Michail Andreas Michalopoulos (1):
      netfilter: flowtable: extend ct timeout of offloaded GRE flows

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload

Xingyuan Mo (1):
      netfilter: nft_set_rbtree: check catchall_sync return before queue_done

Zihan Xi (1):
      netfilter: nf_dup: preserve guard across NFQUEUE reinjection

 include/linux/netdevice_xmit.h              |   4 +-
 include/net/ip_vs.h                         |   4 +-
 include/net/netfilter/nf_conntrack_helper.h |  15 ++++
 include/net/netfilter/nf_dup_netdev.h       |  35 ---------
 include/net/netfilter/nf_queue.h            |   1 +
 include/net/netfilter/nf_recursion.h        |  42 +++++++++++
 net/bridge/netfilter/nf_conntrack_bridge.c  |   2 +-
 net/ipv4/netfilter/arp_tables.c             |   5 +-
 net/ipv4/netfilter/ip_tables.c              |   5 +-
 net/ipv4/netfilter/nf_reject_ipv4.c         |  12 +++
 net/ipv6/netfilter/ip6_tables.c             |   5 +-
 net/ipv6/netfilter/nf_reject_ipv6.c         |  13 ++++
 net/netfilter/ipvs/ip_vs_app.c              |   2 +-
 net/netfilter/ipvs/ip_vs_core.c             |  15 ++--
 net/netfilter/ipvs/ip_vs_ctl.c              | 109 ++++++++++++++++++++++------
 net/netfilter/ipvs/ip_vs_proto_sctp.c       |   5 ++
 net/netfilter/ipvs/ip_vs_proto_tcp.c        |   5 ++
 net/netfilter/ipvs/ip_vs_proto_udp.c        |   4 +
 net/netfilter/nf_conntrack_expect.c         |  15 +++-
 net/netfilter/nf_conntrack_netlink.c        |  36 ++++++---
 net/netfilter/nf_conntrack_sip.c            |   4 +-
 net/netfilter/nf_dup_netdev.c               |   1 +
 net/netfilter/nf_flow_table_core.c          |   1 +
 net/netfilter/nf_nat_masquerade.c           |   4 +-
 net/netfilter/nf_queue.c                    |   1 +
 net/netfilter/nf_tables_api.c               |  21 +++---
 net/netfilter/nf_tables_offload.c           |   3 +
 net/netfilter/nfnetlink_queue.c             |  17 ++++-
 net/netfilter/nft_fwd_netdev.c              |   1 +
 net/netfilter/nft_set_rbtree.c              |   3 +-
 net/netfilter/xt_NETMAP.c                   |   4 +-
 net/netfilter/xt_recent.c                   |   7 +-
 32 files changed, 288 insertions(+), 113 deletions(-)
 create mode 100644 include/net/netfilter/nf_recursion.h