Commit 4a9d62a8774f for kernel

commit 4a9d62a8774f130a5b8de26ca9f415e6050a9d51
Merge: d5dc1e69fd72 fc04229727d8
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Thu Aug 27 13:13:18 2026 -0700

    Merge tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

    Pablo Neira Ayuso says:

    ====================
    Netfilter fixes for net

    The following patchset contains Netfilter fixes for net:

    1) Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON() from the tproxy
       datapath, a recent bug found a way to reach WARN_ON from datapath
       due to insufficient validation of xt_TPROTO checkentry.
       From Fernando F. Mancera.

    2) Similar to previous patch to replace WARN_ON_ONCE by
       DEBUG_NET_WARN_ON_ONCE() for connlimit. Not known issue, but
       since this patch has been around for a while, let's merge it.
       Also from Fernando.

    3) Move nf_tables harware offload commit path after chain blob
       and audit to reduce chances of leaving the hardware in
       inconsistent state.

    4) Add missing vzeroupper to nf_tables pipapo AVX2 to address
       performace degradation to later user of SSE code,
       from Eric Biggers.

    5) Remove pr_debug() in x_tables extensions, a recent bogus found a
       way to print a unsanitized string in xt_IDLETIMER, many of these
       pr_debug() calls are there for historical reasons.

    6) Use pr_info_ratelimited() in x_tables .checkentry.

    7) Fix an imbalance in module refcount due to incorrect override
       expression logic with sets. Remove unnecessary clone in control
       plane, use the existing expressions provided by set or dynset
       expression. Release override expressions only.

    8) Tigthen nf_tables device name removal, it is possible to remove
       prefix strings with exact device name. From Fernando F. Mancera.

    9) Set on the set dead bit earlier, otherwise it is possible to
       call .commit on deleted sets. This also addresses the
       re-introduction of a bug.

    * tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
      netfilter: nf_tables: remove leftover set_update_list
      netfilter: nf_tables: set on dead bit when performing early element removal
      netfilter: nf_tables: skip double clone set expressions on element insert
      netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
      netfilter: x_tables: remove pr_debug
      netfilter: nft_set_pipapo_avx2: add missing vzeroupper
      netfilter: nf_tables: move hardware offload step after building the chain blob
      netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit
      netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
    ====================

    Link: https://patch.msgid.link/20260827141733.423453-1-pablo@netfilter.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>