[PATCH net 0/3] Netfilter fixes for net

[Florian Westphal <fw@strlen.de>]

The following patchset contains Netfilter fixes for *net*:

1) I managed to add a null dereference crash in nft_set_pipapo
   in the current development cycle, was not caught by CI
   because the avx2 implementation is fine, but selftest
   splats when run on non-avx2 host.

2) Fix the ipvs estimater kthread affinity, was incorrect
   since 6.14. From Frederic Weisbecker.

3) nf_tables should not allow to add a device to a flowtable
   or netdev chain more than once -- reject this.
   From Pablo Neira Ayuso.  This has been broken for long time,
   blamed commit dates from v5.8.

Please, pull these changes from:
The following changes since commit d7e82594a45c5cb270940ac469846e8026c7db0f:

  selftests: tls: test TCP stealing data from under the TLS socket (2025-08-12 18:59:06 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-13

for you to fetch changes up to cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973:

  netfilter: nf_tables: reject duplicate device on updates (2025-08-13 08:34:55 +0200)

----------------------------------------------------------------
netfilter pull request nf-25-08-13

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nft_set_pipapo: fix null deref for empty set

Frederic Weisbecker (1):
      ipvs: Fix estimator kthreads preferred affinity

Pablo Neira Ayuso (1):
      netfilter: nf_tables: reject duplicate device on updates

 include/net/ip_vs.h            | 13 +++++++++++++
 kernel/kthread.c               |  1 +
 net/netfilter/ipvs/ip_vs_est.c |  3 ++-
 net/netfilter/nf_tables_api.c  | 30 ++++++++++++++++++++++++++++++
 net/netfilter/nft_set_pipapo.c |  5 ++---
 5 files changed, 48 insertions(+), 4 deletions(-)
-- 
2.49.1