mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
7b53449540
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmp6Gj8ACgkQ1w0aZmrP
KyEx1g//bypx1snnipwTemj5j+X/X+GXgM69s6uwgTWsgSzV8pcJMJHRHPiN4K7J
1S7oDX/M0Rzy2vmapOHvSulS2cOqXdaMPNRu+Ck0OAEAMCEEUBPA/wQDaxAT977z
0UulzQi0c29JAsWGvHWO0LeLJ9+EFT6/piLxoAdd9R7LHsqkNQl+oxeiuetSm7F7
y2A4x7coLHC5EkrLXg++7H/kGI62I/UloKpwaqx5dCzktQxLaOYdINtmdTGD2A2v
L5xO+ptegjJjrUL8ogopY1O/Dek3BMLtAbWyJ3qjx9Qe20Ts5yG9bmy4WmpoZC5S
QVBjKcdOkhkhjg/dQVtRRyF6KxUjFm6cvCgxfw2XEHCYk6wyLWpdXxuPkAuwjoO2
Jig/BZDm3GEdUqBvXVPGbak8Kv7kcQAwgxhqIsEUgQ77zgxNZDBzK3VyEa7Zpydq
xF2LL4zGEL4QCojD+JtjRXqdXr4F+WgzMIFNLQrIvNzwDyDpwdUMuj+MilOyFEJo
xIcSgJnkpr5mtD3ib7+rUnxKhZfhag5IIUyAwq/16+UXa9aM4qbqrm2JScevm789
e+0iArkAYXaaOzmRmu5iiDqldt5gG3gAELLs50YFT+KwU/yZYyLJNMTIMSR/eO3w
7wZhDBe2fOXdj5NY/qTRFbdAnF4VAPXfSob7/E7nRch8VT75YIU=
=p0hS
-----END PGP SIGNATURE-----
Merge tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes for net
The following patchset contains Netfilter/IPVS fixes for net. Still
large batch for this late -rc cycle but at least half of these fixes
in this batch have been cooking for several weeks before:
1) Fix race between ipset list:set GC and swap, use write_lock instead
of rcu read lock section when accessing the index to ensure
interference with ip_set_swap(), from Xiang Mei.
2) Release template conntrack in bridge conntrack when packet is
neither IPv4 nor IPv6 before setting skb as untracked.
From Zhiling Zou.
3) A series of 3 patches for IPVS to address sashiko reports:
Schedulers read destination overload state while connection
accounting and destination configuration can update it concurrently.
The first patch adds a single total connection counter. The second
patch uses it to identify threshold crossings precisely, and updates
OVERLOAD at the crossings and on a threshold edit under dst_lock.
The third patch moves configuration-controlled AVAILABLE to a
separate cflags word, so it cannot clobber OVERLOAD through an
unrelated read-modify-write update.
4) Log invalid packets in TCP and SCTP connection tracking to address
a deadlock when nfnetlink_log is used as logging backend and the
nfnetlink_log conntrack glue support is used. From Zihan Xi.
5) Wait for rcu grace period before releasing pernet state in
nfnetlink_log, otherwise packets can end up access already released
memory, triggering UaF. From Florian Westphal.
6) IPVS needs to reset IP information in control buffer in skbuff when
encapsulating IP packets in ICMP, from Kyle Zeng.
7) IPVS needs to validate ihl field of inner headers in when handling
ICMP response, from Julian Anastasov.
8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload
when triggering ENOMEM on GFP_KERNEL allocation,
from Alexey Velichayshiy.
9) Publish reply tuple into the flowtable hashtable first, otherwise
GC might walk over a released tuple when insertion of the original
tuple fail. From Jeremy Jean.
10) Elide counter increment when replacing an ipset element,
from Florian Westphal.
11) Remove unneeded ipset accounting resets on destruction/flush,
from Florian Westphal.
* tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: ipset: let destroy callbacks adjust ext mem size
netfilter: ipset: fix list type element drift bug
netfilter: flowtable: publish GC-visible tuple last
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
ipvs: revalidate ihl to prevent out-of-bounds access
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
netfilter: nf_conntrack: defer invalid log until after unlock
ipvs: separate destination availability state
ipvs: properly update the overload flag on dest edit
ipvs: add totalconns for dest
netfilter: bridge: release template ct on non-IP path
netfilter: ipset: fix refcount race between list:set GC and swap
====================
Link: https://patch.msgid.link/20260810190621.894119-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|---|---|---|
| .. | ||
| acpi | ||
| asm-generic | ||
| clocksource | ||
| crypto | ||
| cxl | ||
| drm | ||
| dt-bindings | ||
| hyperv | ||
| keys | ||
| kunit | ||
| kvm | ||
| linux | ||
| math-emu | ||
| media | ||
| memory | ||
| misc | ||
| net | ||
| pcmcia | ||
| ras | ||
| rdma | ||
| rv | ||
| scsi | ||
| soc | ||
| sound | ||
| target | ||
| trace | ||
| uapi | ||
| ufs | ||
| vdso | ||
| video | ||
| xen | ||
| Kbuild | ||