linux.git/net/netfilter, branch v7.2-rc1

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

2026-06-25T21:09:26+00:00

Pull bpf fixes from Alexei Starovoitov:

 - Fix effective prog array index with BPF_F_PREORDER (Amery Hung)

 - Zero-initialize the fib lookup flow struct (Avinash Duduskar)

 - Disable xfrm_decode_session hook attachment (Bradley Morgan)

 - Allow type tag BTF records to succeed other modifier records (Emil
   Tsalapatis)

 - Fix build_id caching in stack_map_get_build_id_offset() (Ihor
   Solodrai)

 - Add missing access_ok call to copy_user_syms (Jiri Olsa)

 - Fix stack slot index in nospec checks (Nuoqi Gui)

 - Preserve pointer spill metadata during half-slot cleanup (Nuoqi Gui)

 - Fix partial copy of non-linear test_run output (Sun Jian)

 - Fix BPF_PROG_ASSOC_STRUCT_OPS last field check (Thiébaud Weksteen)

 - Reset register bounds before narrowing retval range (Tristan Madani)

 - Fix vmlinux BTF leak in bpftool cgroup commands (Yichong Chen)

 - Guard error writes in conntrack kfuncs (Yiyang Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Disable xfrm_decode_session hook attachment
  selftests/bpf: Add test for stale bounds on LSM retval context load
  bpf: Reset register bounds before narrowing retval range in check_mem_access()
  selftests/bpf: Cover small conntrack opts error writes
  bpf: Guard conntrack opts error writes
  selftests/bpf: Cover half-slot cleanup of pointer spills
  bpf: Preserve pointer spill metadata during half-slot cleanup
  selftests/bpf: Test cgroup link replace with BPF_F_PREORDER
  bpf: Fix effective prog array index with BPF_F_PREORDER
  bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check
  bpf: zero-initialize the fib lookup flow struct
  bpftool: Fix vmlinux BTF leak in cgroup commands
  bpf: Add missing access_ok call to copy_user_syms
  bpf: Allow type tag BTF records to succeed other modifier records
  bpf: Emit verbose message when prog-specific btf_struct_access rejects a write
  bpf: Fix build_id caching in stack_map_get_build_id_offset()
  bpf: Fix partial copy of non-linear test_run output
  selftests/bpf: Cover stack nospec slot indexing
  bpf: Fix stack slot index in nospec checks

netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration

2026-06-23T11:10:48+00:00

On helper registration, the maximum number of expectations cannot go over
NF_CT_EXPECT_MAX_CNT (255), but zero can be specified then
nf_conntrack_expect_max applies. Turn zero into NF_CT_EXPECT_MAX_CNT
otherwise, expectation LRU eviction on insertion is disabled.

Moreover, expand this sanity check all expectation classes.

This max_expecy policy is only tunable since userspace helpers are
available, set Fixes: tag to the commit that adds such infrastructure.

Remove the check for p->max_expected given this field must always
be non-zero after this patch.

Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_ct: expectation timeouts are passed in milliseconds

2026-06-23T11:10:47+00:00

Userspace passes '5000' in case user asks for 5 seconds.

Allowing for sub-second expectation lifetimes makes sense to me. so
fix up the kernel side instead of munging nft to send a value rounded
up to next second.

Also note that this violates nft convention of passing integers in
network byte order, but we can't change this anymore.

Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support")
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack_expect: run expectation eviction with no helper

2026-06-23T11:10:34+00:00

Run expectation eviction if no helper is specified to deal with the
nft_ct expectation support.

Cap the maximum expectation limit per master conntrack to
NF_CT_EXPECT_MAX_CNT (255).

Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support")
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_conntrack_expect: store master_tuple in expectation

2026-06-23T11:10:34+00:00

Store master conntrack tuple in the expectation since exp->master might
refer to a different conntrack when accessed from rcu read side lock
area due to typesafe rcu rules.

Fixes: 02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation")
Signed-off-by: Pablo Neira Ayuso

netfilter: conntrack: add deprecation warnings for irc and pptp trackers

2026-06-23T11:10:34+00:00

IRC Direct client-to-client requires plaintext.  IRC over TLS should be
preferred, making this helper ineffective.  Add a deprecation warning and
update the help text to better reflect that this is needed for the DCC
extension, not IRC itself.

PPTP is esoteric these days and it is the only helper that requires the
destroy callback in the conntrack helper API.

Removal would simplify the conntrack core.

Both helpers are IPv4 only.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: ctnetlink: do not allow to reset helper on existing conntrack

2026-06-23T06:11:22+00:00

This feature allows to reset a helper for an existing conntrack, but it
is not safe. This requires a synchronized_rcu() call after resetting the
helper, which is going to be expensive for a large batch of conntrack
entries. This also needs to call to the .destroy callback to release the
GRE/PPTP mappings to fix it.

This feature antedates the creation of the conntrack-tools and I cannot
find a good use-case for this. Given that I cannot find any user in the
netfilter.org userspace tree, I prefer to remove this feature.

Fixes: c1d10adb4a52 ("[NETFILTER]: Add ctnetlink port for nf_conntrack")
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_compat: ebtables emulation must reject non-bridge targets

2026-06-23T06:11:22+00:00

xtables targets return netfilter verdicts: NF_ACCEPT, NF_DROP, and so
on.  ebtables targets return incompatible verdicts: EBT_ACCEPT,
EBT_DROP, ...   We cannot allow fallback to NFPROTO_UNSPEC.

ebtables doesn't permit this since
11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")
but that commit missed the nft_compat layer.

Reported-by: Ren Wei 
Reported-by: Wyatt Feng 
Reported-by: Yuan Tan 
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Reported-by: Zhengchuan Liang 
Reported-by: Xin Liu 
Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nft_synproxy: stop bypassing the priv->info snapshot

2026-06-23T06:11:22+00:00

nft_synproxy_eval_v4() and nft_synproxy_eval_v6() already take a
whole-object READ_ONCE() snapshot of the shared priv->info state before
building the SYNACK reply, but nft_synproxy_tcp_options() still masks
opts->options with priv->info.options from the live shared object.

When a named synproxy object is updated concurrently with SYN traffic,
the eval path can then mix mss and timestamp handling from the local
snapshot with an options mask taken from a newer configuration, so one
SYNACK no longer reflects a coherent synproxy configuration.

Use info->options so nft_synproxy_tcp_options() stays on the same local
snapshot that the eval path already copied from priv->info.

Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Runyu Xiao 
Reviewed-by: Fernando Fernandez Mancera 
Signed-off-by: Pablo Neira Ayuso

netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()

2026-06-23T06:11:21+00:00

Add sanity check for iph->ihl field in nf_flow_ip4_tunnel_proto() before
using it to compute the header size, avoiding out-of-bounds access with
malformed IP headers.
While at it, use iph->protocol instead of the hardcoded IPPROTO_IPIP
constant when setting ctx->tun.proto and reference ctx->tun.hdr_size
when updating ctx->offset.

Fixes: ab427db178858 ("netfilter: flowtable: Add IPIP rx sw acceleration")
Signed-off-by: Lorenzo Bianconi 
Signed-off-by: Pablo Neira Ayuso