Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 fixes insufficient sanitization of netlink attributes for the
inner expression which can trigger nul-pointer dereference,
from Davide Ornaghi.
Patch #2 address a report that there is a race condition between
namespace cleanup and the garbage collection of the list:set
type. This patch resolves this issue with other minor issues
as well, from Jozsef Kadlecsik.
Patch #3 ip6_route_me_harder() ignores flowlabel/dsfield when ip dscp
has been mangled, this unbreaks ip6 dscp set $v,
from Florian Westphal.
All of these patches address issues that are present in several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-06-11
Thanks.
----------------------------------------------------------------
The following changes since commit 36534d3c54537bf098224a32dc31397793d4594d:
tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (2024-06-10 19:50:10 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-06-11
for you to fetch changes up to 6f8f132cc7bac2ac76911e47d5baa378aafda4cb:
netfilter: Use flowlabel flow key when re-routing mangled packets (2024-06-11 18:46:04 +0200)
----------------------------------------------------------------
netfilter pull request 24-06-11
----------------------------------------------------------------
Davide Ornaghi (1):
netfilter: nft_inner: validate mandatory meta and payload
Florian Westphal (1):
netfilter: Use flowlabel flow key when re-routing mangled packets
Jozsef Kadlecsik (1):
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
net/ipv6/netfilter.c | 1 +
net/netfilter/ipset/ip_set_core.c | 81 ++++++++++++++++++++---------------
net/netfilter/ipset/ip_set_list_set.c | 30 ++++++-------
net/netfilter/nft_meta.c | 3 ++
net/netfilter/nft_payload.c | 4 ++
5 files changed, 68 insertions(+), 51 deletions(-)
