[net,0/3] Netfilter fixes for net

Pull-request

git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-03-06

Message

Pablo Neira Ayuso March 6, 2025, 3:34 p.m. UTC

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix racy non-atomic read-then-increment operation with
   PREEMPT_RT in nft_ct, from Sebastian Andrzej Siewior.

2) GC is not skipped when jiffies wrap around in nf_conncount,
   from Nicklas Bo Jensen.

3) flush_work() on nf_tables_destroy_work waits for the last queued
   instance, this could be an instance that is different from the one
   that we must wait for, then make destruction work queue.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-03-06

Thanks.

P.S: This is coming late after net-6.14-rc6, please, apply after your
pending pull request is accepted. Thanks.

----------------------------------------------------------------

The following changes since commit a466fd7e9fafd975949e5945e2f70c33a94b1a70:

  caif_virtio: fix wrong pointer check in cfv_probe() (2025-02-28 18:04:23 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-03-06

for you to fetch changes up to fb8286562ecfb585e26b033c5e32e6fb85efb0b3:

  netfilter: nf_tables: make destruction work queue pernet (2025-03-06 13:35:54 +0100)

----------------------------------------------------------------
netfilter pull request 25-03-06

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nf_tables: make destruction work queue pernet

Nicklas Bo Jensen (1):
      netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around

Sebastian Andrzej Siewior (1):
      netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.

 include/net/netfilter/nf_tables.h |  4 +++-
 net/netfilter/nf_conncount.c      |  4 ++--
 net/netfilter/nf_tables_api.c     | 24 ++++++++++++++----------
 net/netfilter/nft_compat.c        |  8 ++++----
 net/netfilter/nft_ct.c            |  6 ++++--
 5 files changed, 27 insertions(+), 19 deletions(-)