[PATCH net 0/7] Netfilter fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter fixes for net:

1) Reinstantiate Florian Westphal as a Netfilter maintainer.

2) Depend on both NETFILTER_XTABLES and NETFILTER_XTABLES_LEGACY,
   from Arnd Bergmann.

3) Use id to annotate last conntrack/expectation visited to resume
   netlink dump, patches from Florian Westphal.

4) Fix bogus element in nft_pipapo avx2 lookup, introduced in
   the last nf-next batch of updates, also from Florian.

5) Return 0 instead of recycling ret variable in
   nf_conntrack_log_invalid_sysctl(), introduced in the last
   nf-next batch of updates, from Dan Carpenter.

6) Fix WARN_ON_ONCE triggered by syzbot with larger cgroup level
   in nft_socket.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-08-07

Thanks.

----------------------------------------------------------------

The following changes since commit d942fe13f72bec92f6c689fbd74c5ec38228c16a:

  net: ti: icssg-prueth: Fix skb handling for XDP_PASS (2025-08-05 18:03:33 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-07

for you to fetch changes up to 1dee968d22eaeb3eede70df513ab3f8dd1712e3e:

  netfilter: nft_socket: remove WARN_ON_ONCE with huge level value (2025-08-07 13:19:26 +0200)

----------------------------------------------------------------
netfilter pull request 25-08-07

----------------------------------------------------------------
Arnd Bergmann (1):
      netfilter: add back NETFILTER_XTABLES dependencies

Dan Carpenter (1):
      netfilter: conntrack: clean up returns in nf_conntrack_log_invalid_sysctl()

Florian Westphal (4):
      MAINTAINERS: resurrect my netfilter maintainer entry
      netfilter: ctnetlink: fix refcount leak on table dump
      netfilter: ctnetlink: remove refcounting in expectation dumpers
      netfilter: nft_set_pipapo: don't return bogus extension pointer

Pablo Neira Ayuso (1):
      netfilter: nft_socket: remove WARN_ON_ONCE with huge level value

 MAINTAINERS                             |  1 +
 net/bridge/netfilter/Kconfig            |  1 +
 net/ipv4/netfilter/Kconfig              |  3 ++
 net/ipv6/netfilter/Kconfig              |  1 +
 net/netfilter/nf_conntrack_netlink.c    | 65 +++++++++++++++------------------
 net/netfilter/nf_conntrack_standalone.c |  6 +--
 net/netfilter/nft_set_pipapo_avx2.c     | 12 +++---
 net/netfilter/nft_socket.c              |  2 +-
 8 files changed, 46 insertions(+), 45 deletions(-)