netdev - [PATCH net 0/3] Netfilter fixes for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250813113800.20775-1-fw@strlen.de>
Date: Wed, 13 Aug 2025 13:36:35 +0200
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	<netfilter-devel@...r.kernel.org>,
	pablo@...filter.org
Subject: [PATCH net 0/3] Netfilter fixes for net

The following patchset contains Netfilter fixes for *net*:

1) I managed to add a null dereference crash in nft_set_pipapo
   in the current development cycle, was not caught by CI
   because the avx2 implementation is fine, but selftest
   splats when run on non-avx2 host.

2) Fix the ipvs estimater kthread affinity, was incorrect
   since 6.14. From Frederic Weisbecker.

3) nf_tables should not allow to add a device to a flowtable
   or netdev chain more than once -- reject this.
   From Pablo Neira Ayuso.  This has been broken for long time,
   blamed commit dates from v5.8.

Please, pull these changes from:
The following changes since commit d7e82594a45c5cb270940ac469846e8026c7db0f:

  selftests: tls: test TCP stealing data from under the TLS socket (2025-08-12 18:59:06 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-13

for you to fetch changes up to cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973:

  netfilter: nf_tables: reject duplicate device on updates (2025-08-13 08:34:55 +0200)

----------------------------------------------------------------
netfilter pull request nf-25-08-13

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nft_set_pipapo: fix null deref for empty set

Frederic Weisbecker (1):
      ipvs: Fix estimator kthreads preferred affinity

Pablo Neira Ayuso (1):
      netfilter: nf_tables: reject duplicate device on updates

 include/net/ip_vs.h            | 13 +++++++++++++
 kernel/kthread.c               |  1 +
 net/netfilter/ipvs/ip_vs_est.c |  3 ++-
 net/netfilter/nf_tables_api.c  | 30 ++++++++++++++++++++++++++++++
 net/netfilter/nft_set_pipapo.c |  5 ++---
 5 files changed, 48 insertions(+), 4 deletions(-)
-- 
2.49.1