Re: [PATCH net,v2 00/15] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Tue, Nov 03, 2026 at 03:02:52PM +0100, Pablo Neira Ayuso wrote:
> v2: remove kdoc update in nf_conntrack_expect.
>     anything else, just like v1.

There is an issue with patch 6/15 which needs a bit more work.

I will resubmit v3 without 6/15. IPVS patch 2/15 might also need a
second spin.

Preparing v3 here...

> -o-
> 
> Hi,
> 
> The following batch contains Netfilter/IPVS fixes for net, this batch
> addresses LLM findings, several of these fixes has been reproduced by
> syzbot:
>  
> 1) Add recursion count to nf_reject infrastructure to prevent stack
>    overflow, from Fernando F. Mancera.
>  
> 2) Address a infinite loop in RCU list traversal with the TWOS IPVS
>    scheduler, from Darong Lu and Julian Anastasov.
>  
> 3) Use kfree_rcu() to release IPVS parent application to fix UaF,
>    from Chengfeng Ye.
>  
> 4) Fix UaF in IPVS netns removal path due to releasing per-net protocol
>    data too early, from Chengfeng Ye.
>  
> 5) Fix unbounded growth of stale, unmatchable IPVS connection entries,
>    from Julian Anastasov.
>  
> 6) Restrict maximum master conntrack chain depth in ctnetlink,
>    from Florian Westphal.
>  
> 7) Preserve recursion count on nfqueue reinjection, from Zihan Xi.
>  
> 8) Restore GRE timeout in the flowtable, otherwise, WARN_ON_ONCE()
>    is reachable, from Michail Andreas Michalopoulos.
>  
> 9) Check non-null gc transaction in nft_rbtree before queuing it for
>    processing, from Xingyuan Mo.
>  
> 10) Replace WARN_ON_ONCE() by DEBUG_NET_WARN_ON_ONCE() in
>     nf_conntrack_bridge which is reachable if the protocol of the tag
>     of a frame differs from the vlan_protocol of the bridge.
>     From Laveesh Bansal.
> 
> 11) Check x_tables target name is non-null before accessing it when
>     building a new table, from Fernando F. Mancera.
>  
> 12) Fix out-of-bound memory read in nf_conntrack_sip, from
>     Joas Antonio Dos Santos.
>  
> 13) Fix a memleak in nf_tables hardware offload when double deleting
>     the same rule, in the same batch.
>  
> 14) Use a mutex in xt_recent netns exit path instead of spinlock,
>     since proc unregistration might sleep. From Cen Zhang.
>  
> 15) Zero the nf_nat_range2 struct before filling it up, to avoid
>     using stale uninitialized stack data to configure NAT with
>     an esoteric NAT flags combination. From Florian Westphal.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-03
> 
> Thanks.
> 
> ----------------------------------------------------------------
> 
> The following changes since commit cb284914e749388eef402938bdb3115fe1f6d337:
> 
>   net: ipa: Fix double free of the interrupt structure on config error (2026-10-30 19:04:37 -0700)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-11-03
> 
> for you to fetch changes up to 3d234337bbb1e32fab38e4e30da72edc5ddc241f:
> 
>   netfilter: nat: zero newrange before filling it in (2026-11-03 14:50:15 +0100)
> 
> ----------------------------------------------------------------
> netfilter pull request 26-11-03
> 
> ----------------------------------------------------------------
> Cen Zhang (Microsoft) (1):
>       netfilter: xt_recent: do not call remove_proc_entry() under recent_lock
> 
> Chengfeng Ye (2):
>       ipvs: Defer application parent freeing until after RCU readers
>       ipvs: fix protocol data lifetime during namespace teardown
> 
> Darong Lu (1):
>       ipvs: wait grace period while reusing dest from trash
> 
> Fernando Fernandez Mancera (2):
>       netfilter: nft_reject: prevent unbounded recursion in output hooks
>       netfilter: x_tables: check target name before accessing verdict
> 
> Florian Westphal (2):
>       netfilter: nf_conntrack: limit expectation master chain depth
>       netfilter: nat: zero newrange before filling it in
> 
> Joas Antonio dos Santos (1):
>       netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()
> 
> Julian Anastasov (1):
>       ipvs: do not create conns from packets with port 0
> 
> Laveesh Bansal (1):
>       netfilter: bridge: use DEBUG_NET_WARN_ON_ONCE in nf_ct_bridge_refrag()
> 
> Michail Andreas Michalopoulos (1):
>       netfilter: flowtable: extend ct timeout of offloaded GRE flows
> 
> Pablo Neira Ayuso (1):
>       netfilter: nf_tables: fix memleak when rule deletion fails with hardware offload
> 
> Xingyuan Mo (1):
>       netfilter: nft_set_rbtree: check catchall_sync return before queue_done
> 
> Zihan Xi (1):
>       netfilter: nf_dup: preserve guard across NFQUEUE reinjection
> 
>  include/linux/netdevice_xmit.h              |   4 +-
>  include/net/ip_vs.h                         |   4 +-
>  include/net/netfilter/nf_conntrack_helper.h |  15 ++++
>  include/net/netfilter/nf_dup_netdev.h       |  35 ---------
>  include/net/netfilter/nf_queue.h            |   1 +
>  include/net/netfilter/nf_recursion.h        |  42 +++++++++++
>  net/bridge/netfilter/nf_conntrack_bridge.c  |   2 +-
>  net/ipv4/netfilter/arp_tables.c             |   5 +-
>  net/ipv4/netfilter/ip_tables.c              |   5 +-
>  net/ipv4/netfilter/nf_reject_ipv4.c         |  12 +++
>  net/ipv6/netfilter/ip6_tables.c             |   5 +-
>  net/ipv6/netfilter/nf_reject_ipv6.c         |  13 ++++
>  net/netfilter/ipvs/ip_vs_app.c              |   2 +-
>  net/netfilter/ipvs/ip_vs_core.c             |  15 ++--
>  net/netfilter/ipvs/ip_vs_ctl.c              | 109 ++++++++++++++++++++++------
>  net/netfilter/ipvs/ip_vs_proto_sctp.c       |   5 ++
>  net/netfilter/ipvs/ip_vs_proto_tcp.c        |   5 ++
>  net/netfilter/ipvs/ip_vs_proto_udp.c        |   4 +
>  net/netfilter/nf_conntrack_expect.c         |   3 +
>  net/netfilter/nf_conntrack_netlink.c        |  36 ++++++---
>  net/netfilter/nf_conntrack_sip.c            |   4 +-
>  net/netfilter/nf_dup_netdev.c               |   1 +
>  net/netfilter/nf_flow_table_core.c          |   1 +
>  net/netfilter/nf_nat_masquerade.c           |   4 +-
>  net/netfilter/nf_queue.c                    |   1 +
>  net/netfilter/nf_tables_api.c               |  21 +++---
>  net/netfilter/nf_tables_offload.c           |   3 +
>  net/netfilter/nfnetlink_queue.c             |  17 ++++-
>  net/netfilter/nft_fwd_netdev.c              |   1 +
>  net/netfilter/nft_set_rbtree.c              |   3 +-
>  net/netfilter/xt_NETMAP.c                   |   4 +-
>  net/netfilter/xt_recent.c                   |   7 +-
>  32 files changed, 279 insertions(+), 110 deletions(-)
>  create mode 100644 include/net/netfilter/nf_recursion.h
>