Re: [PATCH net 0/6,v2] Netfilter fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Thu, May 23, 2024 at 06:20:13PM +0200, Pablo Neira Ayuso wrote:
> v2: fixes sparse warnings due to incorrect endianness in vlan mangling fix
>     reported by kbuild robot and Paolo Abeni.

I realized checkpatch complains on use of spaces instead of
indentation in patch 4/6.

I can repost the series as v3. Apologies for this comestic issue.

Thanks.

> -o-
> 
> Hi,
> 
> The following patchset contains Netfilter fixes for net:
> 
> Patch #1 syzbot reports that nf_reinject() could be called without
>          rcu_read_lock() when flushing pending packets at nfnetlink
>          queue removal, from Eric Dumazet.
> 
> Patch #2 flushes ipset list:set when canceling garbage collection to
>          reference to other lists to fix a race, from Jozsef Kadlecsik.
> 
> Patch #3 restores q-in-q matching with nft_payload by reverting
>          f6ae9f120dad ("netfilter: nft_payload: add C-VLAN support").
> 
> Patch #4 fixes vlan mangling in skbuff when vlan offload is present
>          in skbuff, without this patch nft_payload corrupts packets
>          in this case.
> 
> Patch #5 fixes possible nul-deref in tproxy no IP address is found in
>          netdevice, reported by syzbot and patch from Florian Westphal.
> 
> Patch #6 removes a superfluous restriction which prevents loose fib
>          lookups from input and forward hooks, from Eric Garver.
> 
> My assessment is that patches #1, #2 and #5 address possible kernel
> crash, anything else in this batch fixes broken features.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-05-23
> 
> Thanks.
> 
> ----------------------------------------------------------------
> 
> The following changes since commit 4b377b4868ef17b040065bd468668c707d2477a5:
> 
>   kprobe/ftrace: fix build error due to bad function definition (2024-05-17 19:17:55 -0700)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-05-23
> 
> for you to fetch changes up to ece92825a1fa31cf704a5898fd599daab5cb6573:
> 
>   netfilter: nft_fib: allow from forward/input without iif selector (2024-05-23 17:56:31 +0200)
> 
> ----------------------------------------------------------------
> netfilter pull request 24-05-23
> 
> ----------------------------------------------------------------
> Alexander Maltsev (1):
>       netfilter: ipset: Add list flush to cancel_gc
> 
> Eric Dumazet (1):
>       netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
> 
> Eric Garver (1):
>       netfilter: nft_fib: allow from forward/input without iif selector
> 
> Florian Westphal (1):
>       netfilter: tproxy: bail out if IP has been disabled on the device
> 
> Pablo Neira Ayuso (2):
>       netfilter: nft_payload: restore vlan q-in-q match support
>       netfilter: nft_payload: skbuff vlan metadata mangle support
> 
>  net/ipv4/netfilter/nf_tproxy_ipv4.c   |  2 +
>  net/netfilter/ipset/ip_set_list_set.c |  3 ++
>  net/netfilter/nfnetlink_queue.c       |  2 +
>  net/netfilter/nft_fib.c               |  8 ++-
>  net/netfilter/nft_payload.c           | 95 ++++++++++++++++++++++++++---------
>  5 files changed, 82 insertions(+), 28 deletions(-)
>