[PATCH net 00/15] IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains IPVS fixes for net:

1)  Avoid out-of-bounds write in ip_vs_nat_icmp_v6() when an ICMPv6
    error embeds a non-first ESP fragment, from Axel Mierczuk.

2)  Update *offset for non-first fragments in ipv6_find_hdr(), so
    callers no longer use the initial offset as if it had been
    updated. Also from Axel.

3)  Rework connection refcounting so the pending and running timer
    hold a reference. This fixes a use-after-free race between
    connection deletion and a concurrent timer callback, from
    Julian Anastasov.

4)  Expire controlled connection chains iteratively instead of
    recursively to avoid kernel stack exhaustion, from Zihan Xi.

5)  Reject zero and configured FTP control ports as data ports in
    the FTP helper, from Zihan Xi.

6)  Skip conntrack templates in ip_vs_ftp_out() to fix a UAF in the
    expectation list after the CT rule is removed, from Theodor
    Arsenij Larionov Trichkine.

7)  Add the seqadj extension before linking the FTP expectation, since
    krealloc() of ct->ext can otherwise leave the expectation pointing
    to freed memory. Also from Theodor.

8)  Update conn flags, seqs and related fields in the backup server
    under cp->lock, from Julian Anastasov.

9)  Read conn flags and seqs atomically in the master when building
    sync messages, from Julian Anastasov.

10) Fix a race that can leave a destination in the overload state
    forever. Also make the LBLC/LBLCR schedulers honor the overload
    state for cached destinations, from Julian Anastasov.

11) Validate cport and IP_VS_CONN_F_NO_CPORT in received sync records.
    This rejects templates and connections that incoming lookups
    cannot match, from Axel Mierczuk.

12) Skip cport 0 connections in ip_vs_conn_out_get(), using the same
    rule as __ip_vs_conn_in_get(). Also from Axel.

13) Do not create connections from packets with client or virtual
    port 0, which could create a duplicate connection for every
    packet, from Julian Anastasov.

14) Wait for an RCU grace period before reusing a destination from
    dest_trash, and before restarting its estimator, from Darong Lu.

15) Pass the netfilter hook's state->sk to the update_pmtu handler,
    and pass a NULL sk to ip_local_out() when forwarding through an
    IPVS tunnel, from Julian Anastasov.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-13

Thanks.

----------------------------------------------------------------

The following changes since commit d1bb235aa409a4e5aeba6c748d953d948625b1e9:

  netfilter: nat: zero newrange before filling it in (2026-11-05 13:31:11 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-13

for you to fetch changes up to 937b060406a547e4d931525e600540726ea26532:

  ipvs: pass correct sk to update_pmtu and on tunneling (2026-11-13 02:08:35 +0100)

----------------------------------------------------------------
netfilter pull request 26-11-13

----------------------------------------------------------------
Axel Mierczuk (4):
      ipvs: avoid out-of-bounds write in ip_vs_nat_icmp_v6
      ipv6: update *offset for non-first fragments in ipv6_find_hdr()
      ipvs: validate cport in received sync records
      ipvs: skip cport 0 connections in ip_vs_conn_out_get()

Darong Lu (1):
      ipvs: wait grace period before reusing destinations

Julian Anastasov (6):
      ipvs: fix problems during connection deletion
      ipvs: update flags and seqs in backup server under lock
      ipvs: read flags and seqs in master atomically
      ipvs: honor the overload state and do not enter it forever
      ipvs: do not create conns from packets with port 0
      ipvs: pass correct sk to update_pmtu and on tunneling

Theodor Arsenij Larionov Trichkine (2):
      ipvs: ftp: skip conntrack templates in ip_vs_ftp_out
      ipvs: ftp: add seqadj extension before linking the expectation

Zihan Xi (2):
      ipvs: avoid stack overflow from recursive connection expiration
      ipvs: reject FTP control ports as data ports

 include/net/ip_vs.h                     |  52 ++++++++----
 net/ipv6/exthdrs_core.c                 |   6 +-
 net/netfilter/ipvs/ip_vs_conn.c         | 133 ++++++++++++++++++------------
 net/netfilter/ipvs/ip_vs_core.c         |  58 +++++++++----
 net/netfilter/ipvs/ip_vs_ctl.c          | 140 ++++++++++++++++++++++++--------
 net/netfilter/ipvs/ip_vs_ftp.c          |  39 +++++++--
 net/netfilter/ipvs/ip_vs_lblc.c         |   8 +-
 net/netfilter/ipvs/ip_vs_lblcr.c        |  13 +--
 net/netfilter/ipvs/ip_vs_proto_ah_esp.c |   2 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c   |  12 ++-
 net/netfilter/ipvs/ip_vs_proto_tcp.c    |  12 ++-
 net/netfilter/ipvs/ip_vs_proto_udp.c    |  11 ++-
 net/netfilter/ipvs/ip_vs_sync.c         |  53 ++++++++++--
 net/netfilter/ipvs/ip_vs_xmit.c         | 114 +++++++++++++++++---------
 14 files changed, 462 insertions(+), 191 deletions(-)