Hi,
The following patchset contains Netfilter fixes for net:
1) Fix missing control data in flow dissector, otherwise IP address
matching in hardware offload infra does not work.
2) Fix hardware offload match on prefix IP address when userspace
does not send a bitwise expression to represent the prefix.
3) Insufficient validation of IPSET_ATTR_IPADDR_IPV6 reported
by syzbot.
4) Remove spurious reports on nf_tables when lockdep gets disabled,
from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 849920c703392957f94023f77ec89ca6cf119d43:
devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() (2020-11-14 16:23:19 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 986fbd9842ba114c74b4fb61c4dc146d87a55316:
netfilter: nf_tables: avoid false-postive lockdep splat (2020-11-20 10:18:39 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: ipset: prevent uninit-value in hash_ip6_add
Florian Westphal (1):
netfilter: nf_tables: avoid false-postive lockdep splat
Pablo Neira Ayuso (2):
netfilter: nftables_offload: set address type in control dissector
netfilter: nftables_offload: build mask based from the matching bytes
include/net/netfilter/nf_tables_offload.h | 7 ++++
net/netfilter/ipset/ip_set_core.c | 3 +-
net/netfilter/nf_tables_api.c | 3 +-
net/netfilter/nf_tables_offload.c | 18 ++++++++
net/netfilter/nft_cmp.c | 8 ++--
net/netfilter/nft_meta.c | 16 +++----
net/netfilter/nft_payload.c | 70 +++++++++++++++++++++++--------
7 files changed, 93 insertions(+), 32 deletions(-)
