Hi,
The following patchset contains Netfilter fixes for net:
1) If user requests to wake up a table and hook fails, restore the
dormant flag from the error path, from Florian Westphal.
2) Reset dst after transferring it to the flow object, otherwise dst
gets released twice from the error path.
3) Release dst in case the flowtable selects a direct xmit path, eg.
transmission to bridge port. Otherwise, dst is memleaked.
4) Register basechain and flowtable hooks at the end of the command.
Error path releases these datastructure without waiting for the
rcu grace period.
5) Use kzalloc() to initialize struct nft_hook to fix a KMSAN report
on access to hook type, also from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-22
Thanks.
----------------------------------------------------------------
The following changes since commit 40b9385dd8e6a0515e1c9cd06a277483556b7286:
enic: Avoid false positive under FORTIFY_SOURCE (2024-02-19 10:57:27 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-22
for you to fetch changes up to 195e5f88c2e48330ba5483e0bad2de3b3fad484f:
netfilter: nf_tables: use kzalloc for hook allocation (2024-02-22 00:15:58 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-22
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: set dormant flag on hook register failure
netfilter: nf_tables: use kzalloc for hook allocation
Pablo Neira Ayuso (3):
netfilter: nft_flow_offload: reset dst in route object after setting up flow
netfilter: nft_flow_offload: release dst in case direct xmit path is used
netfilter: nf_tables: register hooks last when adding new chain/flowtable
include/net/netfilter/nf_flow_table.h | 2 +-
net/netfilter/nf_flow_table_core.c | 17 ++++++--
net/netfilter/nf_tables_api.c | 81 ++++++++++++++++++-----------------
3 files changed, 57 insertions(+), 43 deletions(-)
Hi, The following patchset contains Netfilter fixes for net: 1) If user requests to wake up a table and hook fails, restore the dormant flag from the error path, from Florian Westphal. 2) Reset dst after transferring it to the flow object, otherwise dst gets released twice from the error path. 3) Release dst in case the flowtable selects a direct xmit path, eg. transmission to bridge port. Otherwise, dst is memleaked. 4) Register basechain and flowtable hooks at the end of the command. Error path releases these datastructure without waiting for the rcu grace period. 5) Use kzalloc() to initialize struct nft_hook to fix a KMSAN report on access to hook type, also from Florian Westphal. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-22 Thanks. ---------------------------------------------------------------- The following changes since commit 40b9385dd8e6a0515e1c9cd06a277483556b7286: enic: Avoid false positive under FORTIFY_SOURCE (2024-02-19 10:57:27 +0000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-22 for you to fetch changes up to 195e5f88c2e48330ba5483e0bad2de3b3fad484f: netfilter: nf_tables: use kzalloc for hook allocation (2024-02-22 00:15:58 +0100) ---------------------------------------------------------------- netfilter pull request 24-02-22 ---------------------------------------------------------------- Florian Westphal (2): netfilter: nf_tables: set dormant flag on hook register failure netfilter: nf_tables: use kzalloc for hook allocation Pablo Neira Ayuso (3): netfilter: nft_flow_offload: reset dst in route object after setting up flow netfilter: nft_flow_offload: release dst in case direct xmit path is used netfilter: nf_tables: register hooks last when adding new chain/flowtable include/net/netfilter/nf_flow_table.h | 2 +- net/netfilter/nf_flow_table_core.c | 17 ++++++-- net/netfilter/nf_tables_api.c | 81 ++++++++++++++++++----------------- 3 files changed, 57 insertions(+), 43 deletions(-)