| Message ID | 20260927220816.268206-1-pablo@netfilter.org |
|---|---|
| State | Changes Requested |
| Headers | show |
On Mon, 28 Sep 2026 00:08:05 +0200 Pablo Neira Ayuso wrote:
> The following batch contains Netfilter fixes for net:
I didn't spot anything obviously needing a respin in the AI feedback,
could you confirm that it's good as is? If you have to respin it'd be
good to remove the claim that patch 2 is a nop, Linus is onto us for
sending too many LLM-induced, low impact fixes.
Hi Jakub, Paolo, On Mon, Sep 28, 2026 at 07:11:20PM -0700, Jakub Kicinski wrote: > On Mon, 28 Sep 2026 00:08:05 +0200 Pablo Neira Ayuso wrote: > > The following batch contains Netfilter fixes for net: > > I didn't spot anything obviously needing a respin in the AI feedback, > could you confirm that it's good as is? If you have to respin it'd be > good to remove the claim that patch 2 is a nop, Linus is onto us for > sending too many LLM-induced, low impact fixes. I would say yes too. LLM comments say: - Patch 2/11 (ipvs): commit description could be improved (yes, there is always room for improvement in that regard but I think description is fair fine enough). There is a report on a pre-existing issue, but I think that can be addressed as a follow up. - Patch 3/11 (netfilter): commit description could be improved again, but patch is good IMO. - Patch 7/11 (ipvs): there's seem to be another path to abuse this code LLM found, I would address this as a follow up. - Patch 8/11 (netfilter): refers to a pre-existing issue. It also refers to issues with reordering elements of the range, but this API really need elements in order to work fine, otherwise overlap detection will likely fire. - Patch 10/11 (netfilter): refers to a pre-existing issues. nf_flow_offload_refresh() also needs to be disabled in pending work is enqueued. Also disable stats fetching for dying hw entries. In particular, I am observing IPVS patches are getting stuck because of reports of pre-existing issues. Sometimes you find two or three things that need an adjustment, and you can start tackling one of the aspects at a time (because addressing them all at once it not easy). I think it will help Julian if he has a chance to address issues as follow up, unless LLM reports something really sound and compelling that can be classified as a blocker. In that regard, my impression is that LLMs are a bit overwhelming because they complain about one aspect that still needs to be addressed. Not coming in this series, but I can see this is happening too with Florian when he has been addressing some of the existing issues with ipset hashtable resizing. Oh well, and me, because most of the reports here seem to be like pre-existing issues. Just my two cents here, these folks are doing very useful work and they (and me too) will just follow up on pre-existing issues.
Hello, On Tue, 29 Sep 2026, Pablo Neira Ayuso wrote: > Hi Jakub, Paolo, > > On Mon, Sep 28, 2026 at 07:11:20PM -0700, Jakub Kicinski wrote: > > On Mon, 28 Sep 2026 00:08:05 +0200 Pablo Neira Ayuso wrote: > > > The following batch contains Netfilter fixes for net: > > > > I didn't spot anything obviously needing a respin in the AI feedback, > > could you confirm that it's good as is? If you have to respin it'd be > > good to remove the claim that patch 2 is a nop, Linus is onto us for > > sending too many LLM-induced, low impact fixes. > > I would say yes too. LLM comments say: > > - Patch 2/11 (ipvs): commit description could be improved (yes, there > is always room for improvement in that regard but I think description > is fair fine enough). There is a report on a pre-existing issue, but > I think that can be addressed as a follow up. I already have v2 for 2/11, now as 2 patches: https://sashiko.dev/#/patchset/20260929113436.44306-1-ja%40ssi.bg But better to leave it for next week, it is a low priority fix. As usually, if we stop 1 patch, it is replaced by 2 for the next round :) > - Patch 3/11 (netfilter): commit description could be improved again, > but patch is good IMO. > > - Patch 7/11 (ipvs): there's seem to be another path to abuse this > code LLM found, I would address this as a follow up. > > - Patch 8/11 (netfilter): refers to a pre-existing issue. > It also refers to issues with reordering elements of the range, > but this API really need elements in order to work fine, otherwise > overlap detection will likely fire. > > - Patch 10/11 (netfilter): refers to a pre-existing issues. > nf_flow_offload_refresh() also needs to be disabled in pending > work is enqueued. Also disable stats fetching for dying hw entries. > > In particular, I am observing IPVS patches are getting stuck because > of reports of pre-existing issues. Sometimes you find two or three > things that need an adjustment, and you can start tackling one of the > aspects at a time (because addressing them all at once it not easy). > I think it will help Julian if he has a chance to address issues as > follow up, unless LLM reports something really sound and compelling > that can be classified as a blocker. I don't find the LLM reviews wrong, so I don't complain :) I'll note if a followup is preferred but in most of the time the patches need to be corrected. I try to post different patches for the different problems but this is also a load for the other maintainers. I hope I'll improve with the time but it is true that we are overloaded. The only hope is that the bug-report rate will slowdown with the time... Regards -- Julian Anastasov <ja@ssi.bg>
Hi, The following batch contains Netfilter fixes for net: 1) Expand existing ipset fix for bitmap sets to disallow comments updates from kernel-side adds, from Florian Westphal. 2) Drop flowtable reference if nf_ct_netns_get() fails, otherwise flowtable cannot ever be removed, from Aohan Mei. 3) nft_rbtree GC should collect end elements that contained in this transaction batch, new or deleted elements are never expired. From Weiming Shi. 4) Restrict nf_nat_bpf so it does not set unknown NF_NAT_MANIP_* values, from Fernando F. Mancera. 5) Flowtable GC must skip flows that are pending hardware updates, generalize the PENDING flag and use it to inhibit GC. 6) Restore flowtable with ieee80211 which broke due to a relatively recent commit, which was pulled in by -stable, causing a regression in 6.18 kernels. And the following IPVS fixes: 1) Prevent buffer overflow in IPVS sync reported by sashiko, it should only be reproducible on very old 2.6.x kernels, from Julian Anastasov. 2) Fix accounting of cache entries in IPVS LBLC for destinations, from Julian Anastasov. 3) Limit IPVS cache growth for LBLCR and LBLC schedulers, from Zhiling Zou. 4) Restrict IP_VS_CONN_F_ONE_PACKET for normal connections, do not allow to use it with templates. Also from Julian. 5) Sanitize flags in IPVS sync messages received in the backup. From Julian Anastasov. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-27 Thanks. ---------------------------------------------------------------- The following changes since commit 9c572a83037a7dcd653ba3a9cc468c16b857d0c9: net/sched: fix potential stack infoleak in em_text_dump() (2026-09-22 19:14:25 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-27 for you to fetch changes up to 5957f55e476000330f59193b607abcfc0e89d18a: netfilter: flowtable: restore ieee80211 forward path (2026-09-27 22:46:56 +0200) ---------------------------------------------------------------- netfilter pull request 26-09-27 ---------------------------------------------------------------- Aohan Mei (1): netfilter: nft_flow_offload: drop flowtable reference on init error path Fernando Fernandez Mancera (1): netfilter: bpf: reject invalid NAT manipulation types Florian Westphal (1): netfilter: ipset: do not update comments from kernel-side adds Julian Anastasov (4): ipvs: fix buffer overflow when sending sync messages ipvs: fix missing counter decrement in lblc ipvs: do not create invisible templates ipvs: filter some flags received in the backup server Pablo Neira Ayuso (2): netfilter: flowtable: generalize pending status bit netfilter: flowtable: restore ieee80211 forward path Weiming Shi (1): netfilter: nft_set_rbtree: skip transaction elements during GC Zhiling Zou (1): ipvs: bound LBLCR and LBLC cache growth include/linux/netdevice.h | 3 ++ include/net/netfilter/nf_flow_table.h | 2 +- net/mac80211/iface.c | 7 +++++ net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 3 ++ net/netfilter/ipvs/ip_vs_lblc.c | 4 +++ net/netfilter/ipvs/ip_vs_lblcr.c | 3 ++ net/netfilter/ipvs/ip_vs_sync.c | 56 ++++++++++++++++++++++++++------- net/netfilter/nf_flow_table_core.c | 7 ++++- net/netfilter/nf_flow_table_offload.c | 14 +++------ net/netfilter/nf_flow_table_path.c | 3 ++ net/netfilter/nf_nat_bpf.c | 3 ++ net/netfilter/nf_nat_core.c | 5 +-- net/netfilter/nft_flow_offload.c | 7 ++++- net/netfilter/nft_set_rbtree.c | 2 ++ net/sched/act_ct.c | 2 +- 16 files changed, 95 insertions(+), 28 deletions(-)