Merge tag 'nf-26-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for net, they are:

1) Set on HW_DEAD after HW_PENDING is cleared in the flowtable offload
   to ensure GC does not zap it, from Jérémy Jean.

2) Hold the nfnetlink_queue mutex while removing the queue instance
   from the netlink notifier that handles NETLINK_URELEASE to fix a
   possible race with the UNBIND command. From Florian Westphal.

3) Reject route with NULL rt6i_idev in ip6t_rpfilter. From Weiming Shi.

4) Reject rtinfo->addrnr set to zero from ip6t_rt .checkentry path.
   This also fortifies the datapath loop as per Florian's request.
   From Luxiao Xu.

5) Fix checksuming in nft_synproxy for IPv6, from Karl Mehltretter.

6) Revalidate ihl before calling icmp_send() in IPVS,
   from Julian Anastasov.

7) Fix suspicious RCU usage splat in ctnetlink with expectations.

8) Check for expired catchall elements in the insert and deactivate
   path. From Aohan Mei.

* tag 'nf-26-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_tables: skip expired catchall elements on insert and delete
  netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
  ipvs: revalidate ihl before icmp_send
  netfilter: nft_synproxy: use the family-aware checksum helper
  netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
  netfilter: ip6t_rpfilter: reject routes without inet6_dev
  netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
  netfilter: flowtable: publish HW_DEAD after worker is done
====================

Link: https://patch.msgid.link/20260918112844.194503-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions