Hello,
The following set contains netfilter fixes for the *net* tree.
Regressions (rc only):
recent ebtables crash fix was incomplete, it added a memory leak.
The patch to fix possible buffer overrun for BIG TCP in ftp conntrack
tried to be too clever, we cannot re-use ct->lock: NAT engine might
grab it again -> deadlock. Revert back to a global spinlock.
Both from myself.
Remove the documentation for the recently removed
'nf_conntrack_helper' sysctl as well, from Pablo Neira.
The static_branch_inc() that guards the 'chain stats enabled' path
needs to be deferred further, until the entire transaction was created.
From Tetsuo Handa.
Older bugs:
Since 5.3:
nf_tables_addchain may leak pcpu memory in error path when
offloading fails. Also from Tetsuo Handa.
Please consider pulling these changes from
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
----------------------------------------------------------------
The following changes since commit 603ccb3aca717d04a4b1a04e3a7bc3b91eba33e8:
MAINTAINERS: Add myself as a reviewer for Qualcomm ETHQOS Ethernet driver (2022-09-20 13:42:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master
for you to fetch changes up to d25088932227680988a6b794221e031a7232f137:
netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed (2022-09-20 23:50:03 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: ebtables: fix memory leak when blob is malformed
netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed
Pablo Neira Ayuso (1):
netfilter: conntrack: remove nf_conntrack_helper documentation
Tetsuo Handa (2):
netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()
netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()
Documentation/networking/nf_conntrack-sysctl.rst | 9 ---------
net/bridge/netfilter/ebtables.c | 4 +++-
net/netfilter/nf_conntrack_ftp.c | 6 ++++--
net/netfilter/nf_tables_api.c | 8 ++++----
4 files changed, 11 insertions(+), 16 deletions(-)
Hello, The following set contains netfilter fixes for the *net* tree. Regressions (rc only): recent ebtables crash fix was incomplete, it added a memory leak. The patch to fix possible buffer overrun for BIG TCP in ftp conntrack tried to be too clever, we cannot re-use ct->lock: NAT engine might grab it again -> deadlock. Revert back to a global spinlock. Both from myself. Remove the documentation for the recently removed 'nf_conntrack_helper' sysctl as well, from Pablo Neira. The static_branch_inc() that guards the 'chain stats enabled' path needs to be deferred further, until the entire transaction was created. From Tetsuo Handa. Older bugs: Since 5.3: nf_tables_addchain may leak pcpu memory in error path when offloading fails. Also from Tetsuo Handa. Please consider pulling these changes from git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git ---------------------------------------------------------------- The following changes since commit 603ccb3aca717d04a4b1a04e3a7bc3b91eba33e8: MAINTAINERS: Add myself as a reviewer for Qualcomm ETHQOS Ethernet driver (2022-09-20 13:42:55 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master for you to fetch changes up to d25088932227680988a6b794221e031a7232f137: netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed (2022-09-20 23:50:03 +0200) ---------------------------------------------------------------- Florian Westphal (2): netfilter: ebtables: fix memory leak when blob is malformed netfilter: nf_ct_ftp: fix deadlock when nat rewrite is needed Pablo Neira Ayuso (1): netfilter: conntrack: remove nf_conntrack_helper documentation Tetsuo Handa (2): netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() Documentation/networking/nf_conntrack-sysctl.rst | 9 --------- net/bridge/netfilter/ebtables.c | 4 +++- net/netfilter/nf_conntrack_ftp.c | 6 ++++-- net/netfilter/nf_tables_api.c | 8 ++++---- 4 files changed, 11 insertions(+), 16 deletions(-)