[PATCH net 0/3] netfilter updates for net

[Florian Westphal <fw@strlen.de>]

Three late fixes for netfilter:

1) If nf_queue user requests packet truncation below size of l3 header,
   we corrupt the skb, then crash.  Reject such requests.

2) add cond_resched() calls when doing cycle detection in the
   nf_tables graph.  This avoids softlockup warning with certain
   rulesets.

3) Reject rulesets that use nftables 'queue' expression in family/chain
   combinations other than those that are supported.  Currently the ruleset
   will load, but when userspace attempts to reinject you get WARN splat +
   packet drops.

The following changes since commit 9b134b1694ec8926926ba6b7b80884ea829245a0:

  bridge: Do not send empty IFLA_AF_SPEC attribute (2022-07-26 15:35:53 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git

for you to fetch changes up to 47f4f510ad586032b85c89a0773fbb011d412425:

  netfilter: nft_queue: only allow supported familes and hooks (2022-07-26 21:12:42 +0200)

----------------------------------------------------------------
Florian Westphal (3):
  netfilter: nf_queue: do not allow packet truncation below transport header offset
  netfilter: nf_tables: add rescheduling points during loop detection walks
  netfilter: nft_queue: only allow supported familes and hooks

 net/netfilter/nf_tables_api.c   |  6 ++++++
 net/netfilter/nfnetlink_queue.c |  7 ++++++-
 net/netfilter/nft_queue.c       | 27 +++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)
-- 
2.35.1