netdev - [PATCH net 0/7] Netfilter fixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250807112948.1400523-1-pablo@netfilter.org>
Date: Thu,  7 Aug 2025 13:29:41 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net,
	netdev@...r.kernel.org,
	kuba@...nel.org,
	pabeni@...hat.com,
	edumazet@...gle.com,
	fw@...len.de,
	horms@...nel.org
Subject: [PATCH net 0/7] Netfilter fixes for net

Hi,

The following patchset contains Netfilter fixes for net:

1) Reinstantiate Florian Westphal as a Netfilter maintainer.

2) Depend on both NETFILTER_XTABLES and NETFILTER_XTABLES_LEGACY,
   from Arnd Bergmann.

3) Use id to annotate last conntrack/expectation visited to resume
   netlink dump, patches from Florian Westphal.

4) Fix bogus element in nft_pipapo avx2 lookup, introduced in
   the last nf-next batch of updates, also from Florian.

5) Return 0 instead of recycling ret variable in
   nf_conntrack_log_invalid_sysctl(), introduced in the last
   nf-next batch of updates, from Dan Carpenter.

6) Fix WARN_ON_ONCE triggered by syzbot with larger cgroup level
   in nft_socket.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-08-07

Thanks.

----------------------------------------------------------------

The following changes since commit d942fe13f72bec92f6c689fbd74c5ec38228c16a:

  net: ti: icssg-prueth: Fix skb handling for XDP_PASS (2025-08-05 18:03:33 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-07

for you to fetch changes up to 1dee968d22eaeb3eede70df513ab3f8dd1712e3e:

  netfilter: nft_socket: remove WARN_ON_ONCE with huge level value (2025-08-07 13:19:26 +0200)

----------------------------------------------------------------
netfilter pull request 25-08-07

----------------------------------------------------------------
Arnd Bergmann (1):
      netfilter: add back NETFILTER_XTABLES dependencies

Dan Carpenter (1):
      netfilter: conntrack: clean up returns in nf_conntrack_log_invalid_sysctl()

Florian Westphal (4):
      MAINTAINERS: resurrect my netfilter maintainer entry
      netfilter: ctnetlink: fix refcount leak on table dump
      netfilter: ctnetlink: remove refcounting in expectation dumpers
      netfilter: nft_set_pipapo: don't return bogus extension pointer

Pablo Neira Ayuso (1):
      netfilter: nft_socket: remove WARN_ON_ONCE with huge level value

 MAINTAINERS                             |  1 +
 net/bridge/netfilter/Kconfig            |  1 +
 net/ipv4/netfilter/Kconfig              |  3 ++
 net/ipv6/netfilter/Kconfig              |  1 +
 net/netfilter/nf_conntrack_netlink.c    | 65 +++++++++++++++------------------
 net/netfilter/nf_conntrack_standalone.c |  6 +--
 net/netfilter/nft_set_pipapo_avx2.c     | 12 +++---
 net/netfilter/nft_socket.c              |  2 +-
 8 files changed, 46 insertions(+), 45 deletions(-)