From: Jakub Kicinski <kuba@kernel.org>
Date: Wed, 27 May 2026 01:07:28 +0000 (-0700)
Subject: Merge tag 'nf-next-26-05-25' of https://git.kernel.org/pub/scm/linux/kernel/git/netfi... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=09cfce83e89a456a2587b4317b5395438feb2405;p=thirdparty%2Flinux.git

Merge tag 'nf-next-26-05-25' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
netfilter: updates for net-next

The following patchset contains Netfilter fixes and small enhancements:

1) Disable 32-bit x_tables compatibility (32bit binaries on 64bit
   kernel) interface in user namespaces.  This is 'last warning'
   before this is removed for good.

2) Add a configuration toggle for netfilter GCOV profiling. Provide
   dedicated toggles for ipset and ipvs.

3) Remove modular support for nfnetlink and restrict it to built-in only.
   From Pablo Neira Ayuso.

4) Use per-rule hash initval in nf_conncount. This avoids unecessary
   lock contention with short keys (e.g. conntrack zones) in different
   namespaces.

5) Use nf_ct_exp_net() in ctnetlink expectation dumps.
   From Pratham Gupta.

6) Remove a dead conditional in nft_set_rbtree.

7) Fix conntrack helper policy updates to apply per-class values correctly.
   From David Carlier.

8) Fix an off-by-one OOB read in nf_conntrack_irc:parse_dcc(). Use strict
   less-than comparison in the newline search loop to respect the
   exclusive-end pointer convention.  From Muhammad Bilal.

9) Fix typos in nf_conntrack_proto_tcp comments.  From Avinash Duduskar.

10) Restore performance optimization in nft_set_pipapo_avx2 by passing
    the next map index. Refactor lookup logic for clarity and add a
    DEBUG_NET check to document this.

11) Avoid (harmless) u16 overflow in nf_conntrack_ftp when parsing FTP PORT
    and EPRT commands.  Ignore commands where single octet exceeds 255.
    From Giuseppe Caruso.

Patch 12, which removes incorrect (and obviously unused) code from
nft_byteorder was kept back to avoid a net -> net-next merge conflict.

* tag 'nf-next-26-05-25' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nf_conntrack_ftp: avoid u16 overflows
  netfilter: nft_set_pipapo_avx2: restore performance optimization
  netfilter: nf_conntrack_proto_tcp: fix typos in comments
  netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
  netfilter: nfnl_cthelper: apply per-class values when updating policies
  netfilter: nft_set_rbtree: remove dead conditional
  netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
  netfilter: nf_conncount: use per-rule hash initval
  netfilter: allow nfnetlink built-in only
  netfilter: add option for GCOV profiling
  netfilter: x_tables: disable 32bit compat interface in user namespaces
====================

Link: https://patch.msgid.link/20260525182924.28456-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

09cfce83e89a456a2587b4317b5395438feb2405