Re: [PATCH net-next 0/8] Netfilter/IPVS fixes for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

TLDR; I can post new v2 for this PR if needed, the left-over of
LIST_HEAD(set_update_list) in patch #6 is a bit embarrasing from
cosmetic standpoint because I will need a oneliner patch to remove it.
And I can re-target to net.git as Paolo already mentioned.

Anything else can be addressed by follow ups.

See below my comments (extending Florian's) for more details.

On Wed, Aug 19, 2026 at 02:04:17AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > 1) Validate layer 4 header mangling done via nfnetlink_queue and
> >    nft_payload, this is a follow up to recent similar validation
> >    at layer 3. From Zhiling Zou.
> 
> This needs a followup patch to add validation of the checksum field.
> 
> > 2) Do not allocate memory on delete operations in ipset hash:net
> >    type, delete operation must always succeed. From Florian Westphal.
> 
> The AI feedback should be ignored for this one.
> The missing check for the error is valid, it is added in the pending
> rhashtable patchset.

3) Deliver nft_obj overquota packet path notification directly via
   nfnetlink, do not use the control plane batch logic.
   From Fourie Zhang.

AI feedback is not an issue. The overquita events is triggered from
packet path, reordering wrt. to transaction handling is not an issue.

5) Do not expose expectation dead flag to userspace via ctnetlink.

This isn't a bug introduced by this patch but...
ctnetlink_exp_ct_dump_table(), reached via IPCTNL_MSG_EXP_GET with
NLM_F_DUMP plus CTA_EXPECT_MASTER, has no such filter..."

Yes, nf_ct_exp_is_expired() can be added to that path too.

"This is a pre-existing issue ... should the read of exp->flags in
ctnetlink_exp_dump_expect() be READ_ONCE()?"

Yes, there are a few spots in the tree missing READ_ONCE(exp->flags),
including this one in this patch.

6) Make commit set_update_list per-netns to prepare to publish
   set clone earlier.

Yes, there is a left-over LIST_HEAD(set_update_list) that needs to be
removed in nf_tables_commit() path.

7) Publish the set clone earlier from commit path to address set
   lookup failures during table re-creation, this is targetting
   the rbtree and pipapo set backends.

Yes, set->dead flag is not set on now and an issue that was fixed
recently can pop up again.

"Does this open a window where the old ruleset is evaluated against
next-generation set contents?"

Yes, this is know and this patch is a step forward improving the
situation in this regard.

Regarding the check in nft_set_do_lookup(), it is only useful at this
stage to set backends with no .commit interface.

Let me know, thanks.