github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-21 20:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
f30415929b
linux/net/netfilter
History
David Lee f30415929b netfilter: ipset: do not update comments from kernel-side hash adds 
mtype_resize() copies comment pointers with memcpy(), not the comment
objects themselves. During the window after an entry has been copied but
before the table swap and backlog replay, the old table is still
published for packet-side updates while the replacement-table entry
already holds the same ip_set_comment_rcu pointer.

If xt_SET --add-set ... --exist hits that old entry in this window,
mtype_add() calls ip_set_init_comment() even though packet-side adds
carry no comment payload. That call frees the shared comment through the
old entry, so the replacement-table entry now holds a stale pointer.
When the queued add is replayed on the new table, mtype_add() calls
ip_set_init_comment() again and strlen() dereferences the stale pointer.

Fix this in mtype_add() by skipping ip_set_init_comment() when
ext->target marks a packet-side add. Userspace adds still update
comments, while packet-side adds can no longer free comment storage
shared with a resize copy.

Fixes: f66ee0410b ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports")
Cc: stable@vger.kernel.org
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-23 17:58:46 +02:00
..
ipset netfilter: ipset: do not update comments from kernel-side hash adds 2026-07-23 17:58:46 +02:00
ipvs ipvs: fix more places with wrong ipv6 transport offsets 2026-07-10 16:28:47 +02:00
core.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
Kconfig netfilter: conntrack: add deprecation warnings for irc and pptp trackers 2026-06-23 13:10:34 +02:00
Makefile netfilter: allow nfnetlink built-in only 2026-05-24 22:55:47 +02:00
nf_bpf_link.c netfilter: bpf: defer hook memory release until rcu readers are done 2026-03-19 10:26:31 +01:00
nf_conncount.c netfilter: nf_conncount: fix zone comparison in tuple dedup 2026-07-10 16:28:47 +02:00
nf_conntrack_acct.c
nf_conntrack_amanda.c netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper 2026-06-05 13:25:18 +02:00
nf_conntrack_bpf.c bpf: Guard conntrack opts error writes 2026-06-22 16:04:34 -07:00
nf_conntrack_broadcast.c netfilter: nf_conntrack_expect: store master_tuple in expectation 2026-06-23 13:10:34 +02:00
nf_conntrack_core.c netfilter: nf_conntrack_expect: use conntrack GC to reap expectations 2026-06-21 00:18:27 +02:00
nf_conntrack_ecache.c netfilter: ecache: fix inverted time_after() check 2026-07-10 16:28:47 +02:00
nf_conntrack_expect.c netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-07-22 20:34:28 +02:00
nf_conntrack_extend.c netfilter: conntrack: revert ct extension genid infrastructure 2026-06-05 16:16:44 +02:00
nf_conntrack_ftp.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_h323_asn1.c netfilter: nf_conntrack_h323: Correct indentation when H323_TRACE defined 2026-04-08 07:51:31 +02:00
nf_conntrack_h323_main.c netfilter: nf_conntrack_expect: use conntrack GC to reap expectations 2026-06-21 00:18:27 +02:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration 2026-06-23 13:10:48 +02:00
nf_conntrack_irc.c netfilter: conntrack: add deprecation warnings for irc and pptp trackers 2026-06-23 13:10:34 +02:00
nf_conntrack_labels.c netfilter: conntrack: switch connlabels to atomic_t 2023-10-24 13:16:30 +02:00
nf_conntrack_netbios_ns.c netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper 2026-06-05 13:25:18 +02:00
nf_conntrack_netlink.c netfilter: nf_conntrack_expect: zero at allocation time 2026-06-30 05:31:11 +02:00
nf_conntrack_ovs.c netfilter: nf_conntrack_helper: add refcounting from datapath 2026-06-05 16:16:44 +02:00
nf_conntrack_pptp.c netfilter: conntrack: add deprecation warnings for irc and pptp trackers 2026-06-23 13:10:34 +02:00
nf_conntrack_proto_generic.c netfilter: nf_conntrack: Add allow_clash to generic protocol handler 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_gre.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_proto_icmp.c netfilter: nf_conntrack: enable icmp clash support 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_icmpv6.c netfilter: nf_conntrack: enable icmp clash support 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_sctp.c netfilter: skip recording stale or retransmitted INIT 2026-04-28 17:52:19 -07:00
nf_conntrack_proto_tcp.c netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() 2026-06-07 11:13:47 +02:00
nf_conntrack_proto_udp.c netfilter: conntrack: remove UDP-Lite conntrack support 2026-04-10 12:16:26 +02:00
nf_conntrack_proto.c netfilter: nf_conntrack_helper: add refcounting from datapath 2026-06-05 16:16:44 +02:00
nf_conntrack_sane.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_seqadj.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_sip.c netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() 2026-07-22 19:47:17 +02:00
nf_conntrack_snmp.c netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper 2026-06-05 13:25:18 +02:00
nf_conntrack_standalone.c netfilter: conntrack: remove UDP-Lite conntrack support 2026-04-10 12:16:26 +02:00
nf_conntrack_tftp.c netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper 2026-06-05 13:25:18 +02:00
nf_conntrack_timeout.c netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount 2026-06-05 13:11:55 +02:00
nf_conntrack_timestamp.c
nf_dup_netdev.c netfilter pull request 26-06-14 2026-06-15 14:09:57 -07:00
nf_flow_table_bpf.c bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs 2026-01-02 12:04:28 -08:00
nf_flow_table_core.c netfilter: flowtable: use correct direction to set up tunnel route 2026-07-10 16:28:47 +02:00
nf_flow_table_inet.c net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init() 2024-09-12 15:41:03 +02:00
nf_flow_table_ip.c netfilter: flowtable: support IPIP tunnel with direct xmit 2026-07-08 15:33:44 +02:00
nf_flow_table_offload.c netfilter: flowtable: IPIP tunnel hardware offload is not yet support 2026-07-08 15:33:44 +02:00
nf_flow_table_path.c netfilter: nft_flow_offload: zero device address for non-ether case 2026-06-21 00:18:27 +02:00
nf_flow_table_procfs.c
nf_flow_table_xdp.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
nf_hooks_lwtunnel.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
nf_internals.h netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core 2024-06-19 18:41:59 +02:00
nf_log_syslog.c netfilter: nf_log: validate MAC header was set before dumping it 2026-06-10 18:00:01 +02:00
nf_log.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
nf_nat_amanda.c netfilter: conntrack: remove sprintf usage 2026-04-20 23:27:46 +02:00
nf_nat_bpf.c bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs 2026-01-02 12:04:28 -08:00
nf_nat_core.c netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() 2026-06-23 08:11:21 +02:00
nf_nat_ftp.c
nf_nat_helper.c treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
nf_nat_irc.c
nf_nat_masquerade.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
nf_nat_ovs.c netfilter: nf_conntrack: don't rely on implicit includes 2026-01-20 16:23:37 +01:00
nf_nat_proto.c netfilter: conntrack: remove UDP-Lite conntrack support 2026-04-10 12:16:26 +02:00
nf_nat_redirect.c netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses 2023-11-08 16:40:30 +01:00
nf_nat_sip.c netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-07-22 20:34:28 +02:00
nf_nat_tftp.c
nf_queue.c netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst 2026-06-19 12:19:58 +02:00
nf_sockopt.c
nf_synproxy_core.c netfilter: synproxy: fix unaligned memory access in timestamp adjustment 2026-06-05 13:11:55 +02:00
nf_tables_api.c netfilter: nft_set_rbtree: get command skips end element with open interval 2026-07-03 14:45:21 +02:00
nf_tables_core.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nf_tables_offload.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nf_tables_trace.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nfnetlink_acct.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nfnetlink_cthelper.c netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates 2026-07-03 14:45:21 +02:00
nfnetlink_cttimeout.c netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount 2026-06-05 13:11:55 +02:00
nfnetlink_hook.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nfnetlink_log.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
nfnetlink_osf.c netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures 2026-06-05 13:11:54 +02:00
nfnetlink_queue.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
nfnetlink.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
nft_bitwise.c netfilter: nf_tables: fix dst corruption in same register operation 2026-05-22 12:28:46 +02:00
nft_byteorder.c netfilter: nft_byteorder: remove multi-register support 2026-06-01 13:43:53 +02:00
nft_chain_filter.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-12 12:53:34 -07:00
nft_chain_nat.c netfilter: add missing module descriptions 2023-11-08 13:52:32 +01:00
nft_chain_route.c
nft_cmp.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_compat.c netfilter: nft_compat: ebtables emulation must reject non-bridge targets 2026-06-23 08:11:22 +02:00
nft_connlimit.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_counter.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_ct_fast.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_ct.c netfilter: nft_ct: expectation timeouts are passed in milliseconds 2026-06-23 13:10:47 +02:00
nft_dup_netdev.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_dynset.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_exthdr.c netfilter pull request 26-06-14 2026-06-15 14:09:57 -07:00
nft_fib_inet.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_fib_netdev.c netfilter: nft_fib: reject fib expression on the netdev egress hook 2026-06-30 06:37:12 +02:00
nft_fib.c netfilter: nft_fib: reject fib expression on the netdev egress hook 2026-06-30 06:37:12 +02:00
nft_flow_offload.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_fwd_netdev.c netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them 2026-06-14 13:07:03 +02:00
nft_hash.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_immediate.c netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it 2026-04-08 07:51:31 +02:00
nft_inner.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_last.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-02-26 10:23:00 -08:00
nft_limit.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_log.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_lookup.c netfilter: nft_lookup: fix catchall element handling with inverted lookups 2026-07-08 15:33:37 +02:00
nft_masq.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_meta.c netfilter: nft_meta_bridge: add validate callback for get operations 2026-06-21 00:18:26 +02:00
nft_nat.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_numgen.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_objref.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_osf.c netfilter: nf_tables: skip L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
nft_payload.c netfilter: nftables: restrict checkum update offset 2026-06-30 06:45:53 +02:00
nft_queue.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_quota.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_range.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_redir.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_reject_inet.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_reject_netdev.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_reject.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_rt.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_set_bitmap.c netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation 2025-09-10 20:28:24 +02:00
nft_set_hash.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_set_pipapo_avx2.c netfilter: nft_set_pipapo_avx2: restore performance optimization 2026-05-24 22:55:48 +02:00
nft_set_pipapo_avx2.h netfilter: nft_set_pipapo: use avx2 algorithm for insertions too 2025-08-20 13:52:37 +02:00
nft_set_pipapo.c netfilter: nft_set_pipapo: don't leak bad clone into future transaction 2026-06-30 06:37:07 +02:00
nft_set_pipapo.h netfilter: nft_set_pipapo: don't leak bad clone into future transaction 2026-06-30 06:37:07 +02:00
nft_set_rbtree.c netfilter: nft_set_rbtree: get command skips end element with open interval 2026-07-03 14:45:21 +02:00
nft_socket.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_synproxy.c netfilter: nft_synproxy: stop bypassing the priv->info snapshot 2026-06-23 08:11:22 +02:00
nft_tproxy.c netfilter: nf_tables: skip L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
nft_tunnel.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_xfrm.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
utils.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
x_tables.c netfilter: x_tables: add and use xtables_unregister_table_exit 2026-05-08 01:30:16 +02:00
xt_addrtype.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_AUDIT.c audit: add audit_log_nf_skb helper function 2025-12-16 11:04:14 -05:00
xt_bpf.c
xt_cgroup.c netfilter: x_tables: ensure names are nul-terminated 2026-04-01 11:55:29 +02:00
xt_CHECKSUM.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_CLASSIFY.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_cluster.c netfilter: xt_cluster: reject template conntracks in hash match 2026-06-19 12:22:14 +02:00
xt_comment.c
xt_connbytes.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
xt_connlabel.c
xt_connlimit.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
xt_connmark.c netfilter: xt_connmark: reject invalid shift parameters 2026-07-03 14:45:21 +02:00
xt_CONNSECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_conntrack.c
xt_cpu.c netfilter: xt_cpu: prefer raw_smp_processor_id 2026-05-22 12:28:46 +02:00
xt_CT.c netfilter: nf_conntrack_helper: add refcounting from datapath 2026-06-05 16:16:44 +02:00
xt_dccp.c netfilter: add deprecation warning for dccp support 2026-04-08 07:51:27 +02:00
xt_devgroup.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_dscp.c
xt_DSCP.c
xt_ecn.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_esp.c
xt_hashlimit.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_helper.c
xt_hl.c netfilter: xt_HL: add pr_fmt and checkentry validation 2026-04-10 12:16:26 +02:00
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c netfilter: xt_IDLETIMER: Switch to alarm_start_timer() 2026-05-01 21:36:14 +02:00
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_length.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 2023-02-22 21:25:23 -08:00
xt_limit.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_LOG.c
xt_mac.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_mark.c netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds 2025-05-22 17:16:02 +02:00
xt_MASQUERADE.c
xt_multiport.c netfilter: xt_multiport: validate range encoding in checkentry 2026-04-08 13:33:38 +02:00
xt_nat.c netfilter: xt_nat: reject unsupported target families 2026-07-10 16:28:47 +02:00
xt_NETMAP.c
xt_nfacct.c netfilter: xt_nfacct: don't assume acct name is null-terminated 2025-07-25 18:40:43 +02:00
xt_NFLOG.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-21 11:31:26 +02:00
xt_NFQUEUE.c netfilter: xt_NFQUEUE: prefer raw_smp_processor_id 2026-06-01 13:43:52 +02:00
xt_osf.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_owner.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_physdev.c netfilter: xt_physdev: masks are not c-strings 2026-07-10 16:28:47 +02:00
xt_pkttype.c
xt_policy.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_quota.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_rateest.c netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() 2026-07-03 14:45:21 +02:00
xt_RATEEST.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_realm.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_recent.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_REDIRECT.c netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs 2023-03-22 21:48:59 +01:00
xt_repldata.h netfilter: xtables: Use strscpy() instead of strscpy_pad() 2025-03-23 10:53:47 +01:00
xt_sctp.c netfilter: xt_sctp: validate the flag_info count 2023-08-30 17:34:01 +02:00
xt_SECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_set.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_socket.c netfilter: xt_socket: enable defrag after all other checks 2026-04-10 12:16:26 +02:00
xt_state.c
xt_statistic.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_string.c
xt_tcpmss.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_TCPMSS.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_TCPOPTSTRIP.c netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds 2025-05-22 17:16:02 +02:00
xt_tcpudp.c netfilter: x_tables: guard option walkers against 1-byte tail reads 2026-03-10 14:10:42 +01:00
xt_TEE.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_time.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-19 14:16:00 -07:00
xt_TPROXY.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_TRACE.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-21 11:31:26 +02:00
xt_u32.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00