Hi,
The following patchset contains Netfilter/IPVS fixes for net:
1) netlink socket notifier might win race to release objects that are
already pending to be released via commit release path, reported by
syzbot.
2) No need to postpone flow rule release to commit release path, this
triggered the syzbot report, complementary fix to previous patch.
3) Use explicit signed chars in IPVS to unbreak arm, from Jason A. Donenfeld.
4) Missing check for proc entry creation failure in IPVS, from Zhengchao Shao.
5) Incorrect error path handling when BPF NAT fails to register, from
Chen Zhongjin.
6) Prevent huge memory allocation in ipset hash types, from Jozsef Kadlecsik.
Except the incorrect BPF NAT error path which is broken in 6.1-rc, anything
else has been broken for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 363a5328f4b0517e59572118ccfb7c626d81dca9:
net: tun: fix bugs for oversize packet when napi frags enabled (2022-10-31 20:04:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 510841da1fcc16f702440ab58ef0b4d82a9056b7:
netfilter: ipset: enforce documented limit to prevent allocating huge memory (2022-11-02 19:22:23 +0100)
----------------------------------------------------------------
Chen Zhongjin (1):
netfilter: nf_nat: Fix possible memory leak in nf_nat_init()
Jason A. Donenfeld (1):
ipvs: use explicitly signed chars
Jozsef Kadlecsik (1):
netfilter: ipset: enforce documented limit to prevent allocating huge memory
Pablo Neira Ayuso (2):
netfilter: nf_tables: netlink notifier might race to release objects
netfilter: nf_tables: release flow rule object from commit path
Zhengchao Shao (2):
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
net/netfilter/ipset/ip_set_hash_gen.h | 30 ++++++------------------------
net/netfilter/ipvs/ip_vs_app.c | 10 ++++++++--
net/netfilter/ipvs/ip_vs_conn.c | 30 +++++++++++++++++++++++-------
net/netfilter/nf_nat_core.c | 11 ++++++++++-
net/netfilter/nf_tables_api.c | 8 +++++---
5 files changed, 52 insertions(+), 37 deletions(-)
Hi, The following patchset contains Netfilter/IPVS fixes for net: 1) netlink socket notifier might win race to release objects that are already pending to be released via commit release path, reported by syzbot. 2) No need to postpone flow rule release to commit release path, this triggered the syzbot report, complementary fix to previous patch. 3) Use explicit signed chars in IPVS to unbreak arm, from Jason A. Donenfeld. 4) Missing check for proc entry creation failure in IPVS, from Zhengchao Shao. 5) Incorrect error path handling when BPF NAT fails to register, from Chen Zhongjin. 6) Prevent huge memory allocation in ipset hash types, from Jozsef Kadlecsik. Except the incorrect BPF NAT error path which is broken in 6.1-rc, anything else has been broken for several releases. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git Thanks. ---------------------------------------------------------------- The following changes since commit 363a5328f4b0517e59572118ccfb7c626d81dca9: net: tun: fix bugs for oversize packet when napi frags enabled (2022-10-31 20:04:55 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD for you to fetch changes up to 510841da1fcc16f702440ab58ef0b4d82a9056b7: netfilter: ipset: enforce documented limit to prevent allocating huge memory (2022-11-02 19:22:23 +0100) ---------------------------------------------------------------- Chen Zhongjin (1): netfilter: nf_nat: Fix possible memory leak in nf_nat_init() Jason A. Donenfeld (1): ipvs: use explicitly signed chars Jozsef Kadlecsik (1): netfilter: ipset: enforce documented limit to prevent allocating huge memory Pablo Neira Ayuso (2): netfilter: nf_tables: netlink notifier might race to release objects netfilter: nf_tables: release flow rule object from commit path Zhengchao Shao (2): ipvs: fix WARNING in __ip_vs_cleanup_batch() ipvs: fix WARNING in ip_vs_app_net_cleanup() net/netfilter/ipset/ip_set_hash_gen.h | 30 ++++++------------------------ net/netfilter/ipvs/ip_vs_app.c | 10 ++++++++-- net/netfilter/ipvs/ip_vs_conn.c | 30 +++++++++++++++++++++++------- net/netfilter/nf_nat_core.c | 11 ++++++++++- net/netfilter/nf_tables_api.c | 8 +++++--- 5 files changed, 52 insertions(+), 37 deletions(-)