Hi,
The following patchset contains Netfilter fixes for net:
1) Fix esoteric undefined behaviour due to uninitialized stack access
in ip_vs_protocol_init(), from Jinghao Jia.
2) Fix iptables xt_LED slab-out-of-bounds due to incorrect sanitization
of the led string identifier, reported by syzbot. Patch from
Dmitry Antipov.
3) Remove WARN_ON_ONCE reachable from userspace to check for the maximum
cgroup level, nft_socket cgroup matching is restricted to 255 levels,
but cgroups allow for INT_MAX levels by default. Reported by syzbot.
4) Fix nft_inner incorrect use of percpu area to store tunnel parser
context with softirqs, resulting in inconsistent inner header
offsets that could lead to bogus rule mismatches, reported by syzbot.
5) Grab module reference on ipset core while requesting set type modules,
otherwise kernel crash is possible by removing ipset core module,
patch from Phil Sutter.
6) Fix possible double-free in nft_hash garbage collector due to unstable
walk interator that can provide twice the same element. Use a sequence
number to skip expired/dead elements that have been already scheduled
for removal. Based on patch from Laurent Fasnach
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-12-05
Thanks.
----------------------------------------------------------------
The following changes since commit 04f5cb48995d51deed0af71aaba1b8699511313f:
Documentation: tls_offload: fix typos and grammar (2024-11-28 12:09:06 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-12-05
for you to fetch changes up to 7ffc7481153bbabf3332c6a19b289730c7e1edf5:
netfilter: nft_set_hash: skip duplicated elements pending gc run (2024-12-04 21:37:41 +0100)
----------------------------------------------------------------
netfilter pull request 24-12-05
----------------------------------------------------------------
Dmitry Antipov (1):
netfilter: x_tables: fix LED ID check in led_tg_check()
Jinghao Jia (1):
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
Pablo Neira Ayuso (3):
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
netfilter: nft_inner: incorrect percpu area handling under softirq
netfilter: nft_set_hash: skip duplicated elements pending gc run
Phil Sutter (1):
netfilter: ipset: Hold module reference while requesting a module
include/net/netfilter/nf_tables_core.h | 1 +
net/netfilter/ipset/ip_set_core.c | 5 +++
net/netfilter/ipvs/ip_vs_proto.c | 4 +--
net/netfilter/nft_inner.c | 57 +++++++++++++++++++++++++++-------
net/netfilter/nft_set_hash.c | 16 ++++++++++
net/netfilter/nft_socket.c | 2 +-
net/netfilter/xt_LED.c | 4 ++-
7 files changed, 72 insertions(+), 17 deletions(-)
