Re: [PATCH net 00/15] IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

I'm preparing a v2 of this batch with IPVS fixes, we have identified a
few issues in this batch. I plan to submit it by tomorrow.

Apologies and thanks.

On Fri, Nov 13, 2026 at 02:14:32AM +0100, Pablo Neira Ayuso wrote:
> Hi,
> 
> The following patchset contains IPVS fixes for net:
> 
> 1)  Avoid out-of-bounds write in ip_vs_nat_icmp_v6() when an ICMPv6
>     error embeds a non-first ESP fragment, from Axel Mierczuk.
> 
> 2)  Update *offset for non-first fragments in ipv6_find_hdr(), so
>     callers no longer use the initial offset as if it had been
>     updated. Also from Axel.
> 
> 3)  Rework connection refcounting so the pending and running timer
>     hold a reference. This fixes a use-after-free race between
>     connection deletion and a concurrent timer callback, from
>     Julian Anastasov.
> 
> 4)  Expire controlled connection chains iteratively instead of
>     recursively to avoid kernel stack exhaustion, from Zihan Xi.
> 
> 5)  Reject zero and configured FTP control ports as data ports in
>     the FTP helper, from Zihan Xi.
> 
> 6)  Skip conntrack templates in ip_vs_ftp_out() to fix a UAF in the
>     expectation list after the CT rule is removed, from Theodor
>     Arsenij Larionov Trichkine.
> 
> 7)  Add the seqadj extension before linking the FTP expectation, since
>     krealloc() of ct->ext can otherwise leave the expectation pointing
>     to freed memory. Also from Theodor.
> 
> 8)  Update conn flags, seqs and related fields in the backup server
>     under cp->lock, from Julian Anastasov.
> 
> 9)  Read conn flags and seqs atomically in the master when building
>     sync messages, from Julian Anastasov.
> 
> 10) Fix a race that can leave a destination in the overload state
>     forever. Also make the LBLC/LBLCR schedulers honor the overload
>     state for cached destinations, from Julian Anastasov.
> 
> 11) Validate cport and IP_VS_CONN_F_NO_CPORT in received sync records.
>     This rejects templates and connections that incoming lookups
>     cannot match, from Axel Mierczuk.
> 
> 12) Skip cport 0 connections in ip_vs_conn_out_get(), using the same
>     rule as __ip_vs_conn_in_get(). Also from Axel.
> 
> 13) Do not create connections from packets with client or virtual
>     port 0, which could create a duplicate connection for every
>     packet, from Julian Anastasov.
> 
> 14) Wait for an RCU grace period before reusing a destination from
>     dest_trash, and before restarting its estimator, from Darong Lu.
> 
> 15) Pass the netfilter hook's state->sk to the update_pmtu handler,
>     and pass a NULL sk to ip_local_out() when forwarding through an
>     IPVS tunnel, from Julian Anastasov.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-13
> 
> Thanks.
> 
> ----------------------------------------------------------------
> 
> The following changes since commit d1bb235aa409a4e5aeba6c748d953d948625b1e9:
> 
>   netfilter: nat: zero newrange before filling it in (2026-11-05 13:31:11 +0100)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-13
> 
> for you to fetch changes up to 937b060406a547e4d931525e600540726ea26532:
> 
>   ipvs: pass correct sk to update_pmtu and on tunneling (2026-11-13 02:08:35 +0100)
> 
> ----------------------------------------------------------------
> netfilter pull request 26-11-13
> 
> ----------------------------------------------------------------
> Axel Mierczuk (4):
>       ipvs: avoid out-of-bounds write in ip_vs_nat_icmp_v6
>       ipv6: update *offset for non-first fragments in ipv6_find_hdr()
>       ipvs: validate cport in received sync records
>       ipvs: skip cport 0 connections in ip_vs_conn_out_get()
> 
> Darong Lu (1):
>       ipvs: wait grace period before reusing destinations
> 
> Julian Anastasov (6):
>       ipvs: fix problems during connection deletion
>       ipvs: update flags and seqs in backup server under lock
>       ipvs: read flags and seqs in master atomically
>       ipvs: honor the overload state and do not enter it forever
>       ipvs: do not create conns from packets with port 0
>       ipvs: pass correct sk to update_pmtu and on tunneling
> 
> Theodor Arsenij Larionov Trichkine (2):
>       ipvs: ftp: skip conntrack templates in ip_vs_ftp_out
>       ipvs: ftp: add seqadj extension before linking the expectation
> 
> Zihan Xi (2):
>       ipvs: avoid stack overflow from recursive connection expiration
>       ipvs: reject FTP control ports as data ports
> 
>  include/net/ip_vs.h                     |  52 ++++++++----
>  net/ipv6/exthdrs_core.c                 |   6 +-
>  net/netfilter/ipvs/ip_vs_conn.c         | 133 ++++++++++++++++++------------
>  net/netfilter/ipvs/ip_vs_core.c         |  58 +++++++++----
>  net/netfilter/ipvs/ip_vs_ctl.c          | 140 ++++++++++++++++++++++++--------
>  net/netfilter/ipvs/ip_vs_ftp.c          |  39 +++++++--
>  net/netfilter/ipvs/ip_vs_lblc.c         |   8 +-
>  net/netfilter/ipvs/ip_vs_lblcr.c        |  13 +--
>  net/netfilter/ipvs/ip_vs_proto_ah_esp.c |   2 +-
>  net/netfilter/ipvs/ip_vs_proto_sctp.c   |  12 ++-
>  net/netfilter/ipvs/ip_vs_proto_tcp.c    |  12 ++-
>  net/netfilter/ipvs/ip_vs_proto_udp.c    |  11 ++-
>  net/netfilter/ipvs/ip_vs_sync.c         |  53 ++++++++++--
>  net/netfilter/ipvs/ip_vs_xmit.c         | 114 +++++++++++++++++---------
>  14 files changed, 462 insertions(+), 191 deletions(-)
>