Re: [PATCH net 00/15] Netfilter/IPVS fixes for net

[Matthieu Baerts <matttbe@kernel.org>]

Hi Pablo,

On 03/11/2026 14:47, Pablo Neira Ayuso wrote:
> On Tue, Nov 03, 2026 at 02:44:57PM +0100, Pablo Neira Ayuso wrote:
>> On Tue, Nov 03, 2026 at 01:27:30PM +0100, Matthieu Baerts wrote:
>>> Hi Paolo, Pablo,
>>>
>>> On 03/11/2026 13:04, Paolo Abeni wrote:
>>>> On 11/2/26 01:56, Pablo Neira Ayuso wrote:
>>>>> Hi,
>>>>>
>>>>> The following batch contains Netfilter/IPVS fixes for net:
>>>>>
>>>>> 1) Add recursion count to nf_reject infrastructure to prevent stack
>>>>>     overflow, from Fernando F. Mancera.
>>>>>
>>>>> 2) Address a infinite loop in RCU list traversal with the TWOS IPVS
>>>>>     scheduler, from Darong Lu and Julian Anastasov.
>>>>>
>>>>> 3) Use kfree_rcu() to release IPVS parent application to fix UaF,
>>>>>     from Chengfeng Ye.
>>>>>
>>>>> 4) Fix UaF in IPVS netns removal path due to releasing per-net protocol
>>>>>     data too early, from Chengfeng Ye.
>>>>>
>>>>> 5) Fix unbounded growth of stale, unmatchable IPVS connection entries,
>>>>>     from Julian Anastasov.
>>>>>
>>>>> 6) Restrict maximum master conntrack chain depth in ctnetlink,
>>>>>     from Florian Westphal.
>>>>>
>>>>> 7) Preserve recursion count on nfqueue reinjection, from Zihan Xi.
>>>>>
>>>>> 8) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
>>>>>     is reachable, from Michail Andreas Michalopoulos.
>>>>>
>>>>> 9) Check non-null gc transaction in nft_rbtree before queuing it for
>>>>>     processing, from Xingyuan Mo.
>>>>>
>>>>> 10) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
>>>>>      nf_conntrack_bridge which is reachable if the protocol of the tag
>>>>>      of a frame differs from the vlan_protocol of the bridge.
>>>>>      From Laveesh Bansal.
>>>>>
>>>>> 11) Check x_tables target name is non-null before accessing it when
>>>>>      building a new table, from Fernando F. Mancera.
>>>>>
>>>>> 12) Fix out-of-bound memory read in nf_conntrack_sip, from
>>>>>      Joas Antonio Dos Santos.
>>>>>
>>>>> 13) Fix a memleak in nf_tables hardware offload when double deleting
>>>>>      the same rule, in the same batch.
>>>>>
>>>>> 14) Use a mutex in xt_recent netns exit path instead of spinlock,
>>>>>      since proc unregistration might sleep. From Cen Zhang.
>>>>>
>>>>> 15) Zero the nf_nat_range2 struct before filling it up, to avoid
>>>>>      using stale uninitialized stack data to configure NAT with
>>>>>      an esoteric NAT flags combination. From Florian Westphal.
>>>>>
>>>>> Please, pull these changes from:
>>>>>
>>>>>    git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
>>>>> nf-26-11-02
>>>> I'm sorry, but something went very wrong on the nipa side: the tools did
>>>> not pick this PR. Do you mind repost it verbatim?
>>>
>>> It looks like the patches have not been tested, because of the kdoc
>>> issue on patch 6/15:
>>>
>>> https://netdev-ctrl.bots.linux.dev/logview.html?f=/logs/build/1198360/14931104/kdoc/stdout
>>
>> I routinely run checkpath.pl, I will re-check what happened here.
> 
> Well, here I have a script that contains checkpatch.pl and the
> following call as well:
> 
> $ scripts/kernel-doc -none net/netfilter/nf_conntrack_expect.c
> 
> but it shows nothing here.

NIPA uses "-Wall". With it, we can see the issue:

  $ scripts/kernel-doc -Wall -none net/netfilter/nf_conntrack_expect.c
  Warning: net/netfilter/nf_conntrack_expect.c:311 No description found for return value of 'nf_ct_expect_alloc'
  Warning: net/netfilter/nf_conntrack_expect.c:311 No description found for return value of 'nf_ct_expect_alloc'

(And with -Werror, the script returns a non-zero RC code.)

Cheers,
Matt