[PATCH net 00/10] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS fixes for net:

1) Set on HW_DEAD after HW_PENDING is cleared in the flowtable offload
   to ensure GC does not zap it, from Jérémy Jean.

2) Hold the nfnetlink_queue mutex while removing the queue instance
   from the netlink notifier that handles NETLINK_URELEASE to fix a
   possible race with the UNBIND command. From Florian Westphal.

3) Reject route with NULL rt6i_idev in ip6t_rpfilter. From Weiming Shi.

4) Reject rtinfo->addrnr set to zero from ip6t_rt .checkentry path.
   This also fortifies the datapath loop as per Florian's request.
   From Luxiao Xu.

5) Fix checksuming in nft_synproxy for IPv6, from Karl Mehltretter.

6) Revalidate ihl before calling icmp_send() in IPVS,
   from Julian Anastasov.

7) Sanitize flags in IPVS sync messages that are received in the
   backup, from Julian Anastasov.

8) Fix suspicious RCU usage splat in ctnetlink with expectations.

9) Remove WARN_ON_ONCE in dev_fill_forward_path(). Recent support
   from IPIP tunnels allow for loops. From Farhad Alemi.

10) Check for expired catchall elements in the insert and deactivate
    path. From Aohan Mei.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-17

Thanks.

----------------------------------------------------------------

The following changes since commit ceac0de741bfb47ca255eee075257b3bb31f0651:

  netlink: do not free nlk->groups while lockless readers can use it (2026-09-15 18:44:02 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-17

for you to fetch changes up to d9be517d5aef7ebf132b0f33965c7a8232a02da9:

  netfilter: nf_tables: skip expired catchall elements on insert and delete (2026-09-17 01:00:01 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-17

----------------------------------------------------------------
Aohan Mei (1):
      netfilter: nf_tables: skip expired catchall elements on insert and delete

Farhad Alemi (1):
      net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check

Florian Westphal (1):
      netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

Julian Anastasov (2):
      ipvs: revalidate ihl before icmp_send
      ipvs: filter some flags received in the backup server

Jérémy Jean (1):
      netfilter: flowtable: publish HW_DEAD after worker is done

Karl Mehltretter (1):
      netfilter: nft_synproxy: use the family-aware checksum helper

Luxiao Xu (1):
      netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

Naman Gulati (1):
      netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name

Weiming Shi (1):
      netfilter: ip6t_rpfilter: reject routes without inet6_dev

 net/core/dev.c                        |  2 +-
 net/ipv6/netfilter/ip6t_rpfilter.c    |  2 +-
 net/ipv6/netfilter/ip6t_rt.c          | 11 ++++++++---
 net/netfilter/ipvs/ip_vs_core.c       |  6 ++++++
 net/netfilter/ipvs/ip_vs_sync.c       | 33 ++++++++++++++++++++++++++++++---
 net/netfilter/nf_conntrack_netlink.c  |  3 ++-
 net/netfilter/nf_flow_table_offload.c |  7 ++++++-
 net/netfilter/nf_tables_api.c         |  8 ++++++--
 net/netfilter/nfnetlink_queue.c       |  8 +++++---
 net/netfilter/nft_synproxy.c          |  3 ++-
 10 files changed, 67 insertions(+), 16 deletions(-)