Re: [PATCH net-next 1/8] netfilter: validate L4 headers after userspace packet writes

Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <[email protected]>:

On Tue, 18 Aug 2026 01:29:50 +0200 you wrote:
> From: Zhiling Zou <[email protected]>
> 
> NFQUEUE and nft_payload can hand packet data modified by userspace back
> to the stack. Recent restrictions keep link and network headers stable,
> but transport header fields can still be changed.
> 
> A packet can therefore keep the same network header and conntrack entry
> while changing the transport header layout. For TCP, increasing doff can
> make later helper or NAT code use a different transport-header base than
> the parser used, and can make offsets point past skb->tail.
> 
> [...]

Here is the summary with links:
  - [net-next,1/8] netfilter: validate L4 headers after userspace packet writes
    https://git.kernel.org/netdev/net/c/112e447d17f7
  - [net-next,2/8] netfilter: ipset: remove need to allocate memory on delete operations
    https://git.kernel.org/netdev/net/c/e80456d79ec8
  - [net-next,3/8] netfilter: nf_tables: don't queue packet path object notifications
    https://git.kernel.org/netdev/net/c/7904b94768e9
  - [net-next,4/8] netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation
    https://git.kernel.org/netdev/net/c/5fc04d4648f4
  - [net-next,5/8] netfilter: ctnetlink: do not expose expectation DEAD flag
    https://git.kernel.org/netdev/net/c/322371b09058
  - [net-next,6/8] netfilter: nf_tables: move set_update_list to nftables per-netns
    https://git.kernel.org/netdev/net/c/b343ededb3f9
  - [net-next,7/8] netfilter: nf_tables: call set ops .commit when building new ruleset blob
    https://git.kernel.org/netdev/net/c/1e3b9e1c77fe
  - [net-next,8/8] ipvs: fix integer overflow in ftp helper port/address parsing
    https://git.kernel.org/netdev/net/c/e625a9477d12

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html