Skip to contentSkip to conversation

stable request: netfilter: make cgroupsv2 matching work with namespaces

DISCUSSION Florian Westphal 3 participants 3 messages Sep 20, 2024 – Sep 27, 2024

Subsystems (2)
Stable branch netfilter
lore
Share & tools
lore

Florian Westphal

author maintainer
#0 lore raw

Hello,

please consider picking up:
7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces") and its followup fix,
7052622fccb1 ("netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in nft_socket_cgroup_subtree_level()")

It should cherry-pick fine for 6.1 and later.
I'm not sure a 5.15 backport is worth it, as its not a crash fix and noone has reported this problem so far with a 5.15 kernel.

maintainer
#1 lore raw
Quoted 10 lines · Florian Westphal

Hello,

please consider picking up:
7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces") and its followup fix,
7052622fccb1 ("netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in nft_socket_cgroup_subtree_level()")

It should cherry-pick fine for 6.1 and later.
I'm not sure a 5.15 backport is worth it, as its not a crash fix and noone has reported this problem so far with a 5.15 kernel.

I can take of these backports.

maintainer
#2 lore raw
In reply to Florian Westphal
Quoted 11 lines · Florian Westphal

Hello,

please consider picking up:
7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces") and its followup fix,
7052622fccb1 ("netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in nft_socket_cgroup_subtree_level()")

It should cherry-pick fine for 6.1 and later.
I'm not sure a 5.15 backport is worth it, as its not a crash fix and noone has reported this problem so far with a 5.15 kernel.

Now queued up for 6.1 and newer, thanks.

greg k-h