Hi,
The following patchset contains fixes for net:
Patch #1 disallows anonymous sets with timeout, except for dynamic sets.
Anonymous sets with timeouts using the pipapo set backend makes
no sense from userspace perspective.
Patch #2 rejects constant sets with timeout which has no practical usecase.
This kind of set, once bound, contains elements that expire but
no new elements can be added.
Patch #3 restores custom conntrack expectations with NFPROTO_INET,
from Florian Westphal.
Patch #4 marks rhashtable anonymous set with timeout as dead from the
commit path to avoid that async GC collects these elements. Rules
that refers to the anonymous set get released with no mutex held
from the commit path.
Patch #5 fixes a UBSAN shift overflow in H.323 conntrack helper,
from Lena Wang.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-07
Thanks.
----------------------------------------------------------------
The following changes since commit c055fc00c07be1f0df7375ab0036cebd1106ed38:
net/rds: fix WARNING in rds_conn_connect_if_down (2024-03-06 11:58:42 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-07
for you to fetch changes up to 767146637efc528b5e3d31297df115e85a2fd362:
netfilter: nf_conntrack_h323: Add protection for bmp length out of range (2024-03-07 03:10:35 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-07
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_ct: fix l3num expectations with inet pseudo family
Lena Wang (1):
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
Pablo Neira Ayuso (3):
netfilter: nf_tables: disallow anonymous set with timeout flag
netfilter: nf_tables: reject constant set with timeout
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
net/netfilter/nf_conntrack_h323_asn1.c | 4 ++++
net/netfilter/nf_tables_api.c | 7 +++++++
net/netfilter/nft_ct.c | 11 +++++------
3 files changed, 16 insertions(+), 6 deletions(-)
Hi, The following patchset contains fixes for net: Patch #1 disallows anonymous sets with timeout, except for dynamic sets. Anonymous sets with timeouts using the pipapo set backend makes no sense from userspace perspective. Patch #2 rejects constant sets with timeout which has no practical usecase. This kind of set, once bound, contains elements that expire but no new elements can be added. Patch #3 restores custom conntrack expectations with NFPROTO_INET, from Florian Westphal. Patch #4 marks rhashtable anonymous set with timeout as dead from the commit path to avoid that async GC collects these elements. Rules that refers to the anonymous set get released with no mutex held from the commit path. Patch #5 fixes a UBSAN shift overflow in H.323 conntrack helper, from Lena Wang. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-07 Thanks. ---------------------------------------------------------------- The following changes since commit c055fc00c07be1f0df7375ab0036cebd1106ed38: net/rds: fix WARNING in rds_conn_connect_if_down (2024-03-06 11:58:42 +0000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-07 for you to fetch changes up to 767146637efc528b5e3d31297df115e85a2fd362: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (2024-03-07 03:10:35 +0100) ---------------------------------------------------------------- netfilter pull request 24-03-07 ---------------------------------------------------------------- Florian Westphal (1): netfilter: nft_ct: fix l3num expectations with inet pseudo family Lena Wang (1): netfilter: nf_conntrack_h323: Add protection for bmp length out of range Pablo Neira Ayuso (3): netfilter: nf_tables: disallow anonymous set with timeout flag netfilter: nf_tables: reject constant set with timeout netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout net/netfilter/nf_conntrack_h323_asn1.c | 4 ++++ net/netfilter/nf_tables_api.c | 7 +++++++ net/netfilter/nft_ct.c | 11 +++++------ 3 files changed, 16 insertions(+), 6 deletions(-)