Merge tag 'nf-26-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following batch contains Netfilter/IPVS fixes for net. This batch
includes a mix of IPVS follow ups related to Sashiko reports, as well as
crash fixes for connection tracking expectation, helpers, ipset and
nf_tables mostly for old bugs. This also includes a fix for the
flowtable tunnel selftest.

1) Use s32 instead of s16 to calculate the remaining payload containing
   SIP messages, otherwise underflow is possible allowing out-of-bound
   memory access beyond the skb->data area. From Xiang Mei.

2) Fix the counter check in the flowtable selftest for tunnels, from
   Lorenzo Bianconi.

3) Add and use nf_ct_expect_related_pair() to add the RTP and RTCP
   expectations under the expectation lock, this is required by the SIP
   and H.323 NAT helpers. This fixes a possible reinsertion of an
   expectation with the DEAD flag set on while looping to find
   consecutive ports.

4) Fix ipset UaF during table resize by blocking comment updates on
   kernel-side adds. From David Lee.

5) Do not propagate the IP_VS_CONN_F_ONE_PACKET flag when using IPVS
   state synchronization, otherwise reaching stale freed from
   ip_vs_conn struct is possible, Zhiling Zou.

6) Adjust the hn1 hash node when the forwarding method changes between
   MASQ and non-MASQ for an already hashed connection.  This can leave
   stale hash nodes pointing to a freed struct ip_vs_conn and trigger
   UaF while reading /proc/net/ip_vs_conn. From Julian Anastasov.

7) nft_object rhltable needs to be per table, just like chain rhltable,
   otherwise UaF from object lookup path while netns is being released.
   There is also the nlevent path that can reach stale objects. Placing
   this rhltable under the table hierarchy fixes this issue.

8) Reject invalid combined usage of hashlimit tables with and without
   XT_HASHLIMIT_RATE_MATCH flag mode, otherwise access to uninitialized
   .burst field of dsthash_ent is possible.

9) Fix checksum validations in IPVS performed from LOCAL_IN,
   from Julian Anastasov.

10) Fix incorrect packet offset to layer 4 protocol in IPVS, uncovered
    by Sashiko, from Julian Anastasov.

11) Skip the mangling of ICMP replies for non-first fragments, also
    reported by Sashiko. Also from Julian.

12) Clear ip_vs_conn flags under the spinlock to fix a possible data
    race. From Julian Anastasov.

13) Fix incorrect calculation of the payload bitmask in the nf_tables
    hardware offload support, leading to UBSAN splat. From Xiang Mei.

* tag 'nf-26-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nft_payload: fix mask build for partial field offload
  ipvs: clear the nfct flag under lock
  ipvs: do not mangle ICMP replies for non-first fragments
  ipvs: fix places with wrong packet offsets
  ipvs: fix the checksum validations
  netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
  netfilter: nf_tables: make nft_object rhltable per table
  ipvs: adjust double hashing when fwd method changes
  ipvs: do not propagate one-packet flag to synced conns
  netfilter: ipset: do not update comments from kernel-side hash adds
  netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
  selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests
  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
====================

Link: https://patch.msgid.link/20260723163910.274695-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>