Hi,
The following patchset contains Netfilter fixes for net:
1) Reinstantiate Florian Westphal as a Netfilter maintainer.
2) Depend on both NETFILTER_XTABLES and NETFILTER_XTABLES_LEGACY,
from Arnd Bergmann.
3) Use id to annotate last conntrack/expectation visited to resume
netlink dump, patches from Florian Westphal.
4) Fix bogus element in nft_pipapo avx2 lookup, introduced in
the last nf-next batch of updates, also from Florian.
5) Return 0 instead of recycling ret variable in
nf_conntrack_log_invalid_sysctl(), introduced in the last
nf-next batch of updates, from Dan Carpenter.
6) Fix WARN_ON_ONCE triggered by syzbot with larger cgroup level
in nft_socket.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-08-07
Thanks.
----------------------------------------------------------------
The following changes since commit d942fe13f72bec92f6c689fbd74c5ec38228c16a:
net: ti: icssg-prueth: Fix skb handling for XDP_PASS (2025-08-05 18:03:33 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-07
for you to fetch changes up to 1dee968d22eaeb3eede70df513ab3f8dd1712e3e:
netfilter: nft_socket: remove WARN_ON_ONCE with huge level value (2025-08-07 13:19:26 +0200)
----------------------------------------------------------------
netfilter pull request 25-08-07
----------------------------------------------------------------
Arnd Bergmann (1):
netfilter: add back NETFILTER_XTABLES dependencies
Dan Carpenter (1):
netfilter: conntrack: clean up returns in nf_conntrack_log_invalid_sysctl()
Florian Westphal (4):
MAINTAINERS: resurrect my netfilter maintainer entry
netfilter: ctnetlink: fix refcount leak on table dump
netfilter: ctnetlink: remove refcounting in expectation dumpers
netfilter: nft_set_pipapo: don't return bogus extension pointer
Pablo Neira Ayuso (1):
netfilter: nft_socket: remove WARN_ON_ONCE with huge level value
MAINTAINERS | 1 +
net/bridge/netfilter/Kconfig | 1 +
net/ipv4/netfilter/Kconfig | 3 ++
net/ipv6/netfilter/Kconfig | 1 +
net/netfilter/nf_conntrack_netlink.c | 65 +++++++++++++++------------------
net/netfilter/nf_conntrack_standalone.c | 6 +--
net/netfilter/nft_set_pipapo_avx2.c | 12 +++---
net/netfilter/nft_socket.c | 2 +-
8 files changed, 46 insertions(+), 45 deletions(-)
