Commit 24c4c8825946 for kernel

commit 24c4c88259464d38b35c3fbaecb68675de64137d
Merge: b62869a81a7c 3f7a535ff0fa
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Thu Jul 9 11:42:56 2026 +0200

    Merge tag 'nf-26-07-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

    Florian Westphal says:

    ====================
    netfilter: updates for net

    The following patchset contains Netfilter fixes for *net*.

    Most of these are LLM fixes for old issues flagged by sashiko/LLMs.

    Many of these trigger drive-by-findings in sashiko. In particular:

    - many load/store tearing and missing memory barriers, races
      etc. in ipset, esp. with GC and resizing.
      Keeping the proposed patches spinning for yet-another-iteration
      keeps legit fixes back, so I prefer to add these now and follow
      up with other reports later.
    - flowtable work queue still has possible races with teardown,
      but same rationale as with ipset: drive-by findings, not
      problems coming with the flowtable IPIP changeset in this PR.
    - ever since unreadable frag skb support was added in 6.12, we can no
      longer do: BUG_ON(skb_copy_bits( ...): it will fire with such skbs.
      Mina Almasry is looking at similar patterns elsewhere in the stack.

    1) Guard skb->mac_header adjustment after IPv6 defragmentation in
    nf_conntrack_reasm.  From Xiang Mei.

    2) NUL-terminate ebtables table names before calling find_table_lock() to
    prevent stack-out-of-bounds reads.  Also from Xiang Mei.

    3) Zero the ebtables chainstack array, else error unwind may free bogus
    pointer when CPU mask is sparse.  All three issues date from 2.6 days.

    4) Ensure ebtables module names are c-strings, same bug pattern as 2).
    Bug added in 4.6.

    5) Fix catchall element handling for inverted lookups in nft_lookup. Fold the
    catchall lookup into ext before computing the match status.  Was like
    this ever since catchall elements got introduced in 5.13.
    From Tamaki Yanagawa.

    6-9) ipset updates from Jozsef Kadlecsik:
    - mark rcu protected areas correctly
    - address gc and resize clash in the comment extension
    - add/del backlog cleanup in the error path
    - allocate right size for the generic hash structure

    10-12): IPIP flowtable updates from Pablo Neira Ayuso:
     - Use the current direction's route when pushing IPIP headers
       Fix incorrect headroom and fragmentation offset calculations.
     - Avoid hardware offload for IPIP tunnels due to lack of driver support.
     - Support IPIP tunnels with direct xmit in netfilter flowtable.
       dst_cache and dst_cookie are moved outside the union to share route
       state across flows.  This is a followup to work done in 6.19 cycle.

    13) Don't BUG() on skb_copy_bits error. Handle unreadable fragments by
    either returning an error or restricting the copy operations to linear area,
    This became an issue when unreable frag support was merged in 6.12.

    14-16): IPVS updates from Yizhou Zhao:
     - Pass parsed transport offset to IPVS state handlers.
       update callback signatures.
     - use correct transport header offset on state lookp in TCP.
       As-is it was possible for ipv6 extension header data to be
       treated as L4 header.
     - same for SCTP.  This was also broken since 2.6 days.

    17) Ensure inner IP headers in ICMP errors are in the skb headroom after
    stripping outer headers. Add more checks for the length of inner headers.
    This was broken since 3.7 days.
    From Julian Anastasov.

    netfilter pull request nf-26-07-08

    * tag 'nf-26-07-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
      ipvs: ensure inner headers in ICMP errors are in headroom
      ipvs: use parsed transport offset in SCTP state lookup
      ipvs: use parsed transport offset in TCP state lookup
      ipvs: pass parsed transport offset to state handlers
      netfilter: handle unreadable frags
      netfilter: flowtable: support IPIP tunnel with direct xmit
      netfilter: flowtable: IPIP tunnel hardware offload is not yet support
      netfilter: flowtable: use dst in this direction when pushing IPIP header
      netfilter: ipset: allocate the proper memory for the generic hash structure
      netfilter: ipset: cleanup the add/del backlog when resize failed
      netfilter: ipset: exclude gc when resize is in progress
      netfilter: ipset: mark the rcu locked areas properly
      netfilter: nft_lookup: fix catchall element handling with inverted lookups
      netfilter: ebtables: module names must be null-terminated
      netfilter: ebtables: zero chainstack array
      netfilter: ebtables: terminate table name before find_table_lock()
      netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
    ====================

    Link: https://patch.msgid.link/20260708140309.19633-1-fw@strlen.de
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>