Re: [PATCH net 00/15] Netfilter/IPVS fixes for net

[Paolo Abeni <pabeni@redhat.com>]

On 11/2/26 01:56, Pablo Neira Ayuso wrote:
> Hi,
> 
> The following batch contains Netfilter/IPVS fixes for net:
> 
> 1) Add recursion count to nf_reject infrastructure to prevent stack
>     overflow, from Fernando F. Mancera.
> 
> 2) Address a infinite loop in RCU list traversal with the TWOS IPVS
>     scheduler, from Darong Lu and Julian Anastasov.
> 
> 3) Use kfree_rcu() to release IPVS parent application to fix UaF,
>     from Chengfeng Ye.
> 
> 4) Fix UaF in IPVS netns removal path due to releasing per-net protocol
>     data too early, from Chengfeng Ye.
> 
> 5) Fix unbounded growth of stale, unmatchable IPVS connection entries,
>     from Julian Anastasov.
> 
> 6) Restrict maximum master conntrack chain depth in ctnetlink,
>     from Florian Westphal.
> 
> 7) Preserve recursion count on nfqueue reinjection, from Zihan Xi.
> 
> 8) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
>     is reachable, from Michail Andreas Michalopoulos.
> 
> 9) Check non-null gc transaction in nft_rbtree before queuing it for
>     processing, from Xingyuan Mo.
> 
> 10) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
>      nf_conntrack_bridge which is reachable if the protocol of the tag
>      of a frame differs from the vlan_protocol of the bridge.
>      From Laveesh Bansal.
> 
> 11) Check x_tables target name is non-null before accessing it when
>      building a new table, from Fernando F. Mancera.
> 
> 12) Fix out-of-bound memory read in nf_conntrack_sip, from
>      Joas Antonio Dos Santos.
> 
> 13) Fix a memleak in nf_tables hardware offload when double deleting
>      the same rule, in the same batch.
> 
> 14) Use a mutex in xt_recent netns exit path instead of spinlock,
>      since proc unregistration might sleep. From Cen Zhang.
> 
> 15) Zero the nf_nat_range2 struct before filling it up, to avoid
>      using stale uninitialized stack data to configure NAT with
>      an esoteric NAT flags combination. From Florian Westphal.
> 
> Please, pull these changes from:
> 
>    git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-02
I'm sorry, but something went very wrong on the nipa side: the tools did
not pick this PR. Do you mind repost it verbatim?

Thank you!

Paolo