Hello,
The following three patches fix regressions in the netfilter subsystem:
1. Reject attempts to repeatedly toggle the 'dormant' flag in a single
transaction. Doing so makes nf_tables lose track of the real state
vs. the desired state. This ends with an attempt to unregister hooks
that were never registered in the first place, which yields a splat.
2. Fix element counting in the new nftables garbage collection infra
that came with 6.5: More than 255 expired elements wraps a counter
which results in memory leak.
3. Since 6.4 ipset can BUG when a set is renamed while a CREATE command
is in progress, fix from Jozsef Kadlecsik.
The following changes since commit 4e4b1798cc90e376b8b61d0098b4093898a32227:
vxlan: Add missing entries to vxlan_get_size() (2023-09-20 09:00:54 +0100)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-09-20
for you to fetch changes up to 7433b6d2afd512d04398c73aa984d1e285be125b:
netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (2023-09-20 10:35:24 +0200)
Florian Westphal (2):
netfilter: nf_tables: disable toggling dormant table state more than once
netfilter: nf_tables: fix memleak when more than 255 elements expired
Jozsef Kadlecsik (1):
netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
include/net/netfilter/nf_tables.h | 2 +-
net/netfilter/ipset/ip_set_core.c | 12 ++++++++++--
net/netfilter/nf_tables_api.c | 14 ++++++++++++--
3 files changed, 23 insertions(+), 5 deletions(-)
Hello, The following three patches fix regressions in the netfilter subsystem: 1. Reject attempts to repeatedly toggle the 'dormant' flag in a single transaction. Doing so makes nf_tables lose track of the real state vs. the desired state. This ends with an attempt to unregister hooks that were never registered in the first place, which yields a splat. 2. Fix element counting in the new nftables garbage collection infra that came with 6.5: More than 255 expired elements wraps a counter which results in memory leak. 3. Since 6.4 ipset can BUG when a set is renamed while a CREATE command is in progress, fix from Jozsef Kadlecsik. The following changes since commit 4e4b1798cc90e376b8b61d0098b4093898a32227: vxlan: Add missing entries to vxlan_get_size() (2023-09-20 09:00:54 +0100) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-09-20 for you to fetch changes up to 7433b6d2afd512d04398c73aa984d1e285be125b: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (2023-09-20 10:35:24 +0200) Florian Westphal (2): netfilter: nf_tables: disable toggling dormant table state more than once netfilter: nf_tables: fix memleak when more than 255 elements expired Jozsef Kadlecsik (1): netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP include/net/netfilter/nf_tables.h | 2 +- net/netfilter/ipset/ip_set_core.c | 12 ++++++++++-- net/netfilter/nf_tables_api.c | 14 ++++++++++++-- 3 files changed, 23 insertions(+), 5 deletions(-)