Netfilter/IPVS fixes for net

Hi,

The following batch contains Netfilter/IPVS fixes for net. This batch includes a mix of IPVS follow ups related to Sashiko reports, as well as crash fixes for connection tracking expectation, helpers, ipset and nf_tables mostly for old bugs. This also includes a fix for the flowtable tunnel selftest.

1) Use s32 instead of s16 to calculate the remaining payload containing SIP messages, otherwise underflow is possible allowing out-of-bound memory access beyond the skb->data area. From Xiang Mei.

2) Fix the counter check in the flowtable selftest for tunnels, from Lorenzo Bianconi.

3) Add and use nf_ct_expect_related_pair() to add the RTP and RTCP expectations under the expectation lock, this is required by the SIP and H.323 NAT helpers. This fixes a possible reinsertion of an expectation with the DEAD flag set on while looping to find consecutive ports.

4) Fix ipset UaF during table resize by blocking comment updates on kernel-side adds. From David Lee.

5) Do not propagate the IP_VS_CONN_F_ONE_PACKET flag when using IPVS state synchronization, otherwise reaching stale freed from ip_vs_conn struct is possible, Zhiling Zou.

6) Adjust the hn1 hash node when the forwarding method changes between MASQ and non-MASQ for an already hashed connection. This can leave stale hash nodes pointing to a freed struct ip_vs_conn and trigger UaF while reading /proc/net/ip_vs_conn. From Julian Anastasov.

7) nft_object rhltable needs to be per table, just like chain rhltable, otherwise UaF from object lookup path while netns is being released. There is also the nlevent path that can reach stale objects. Placing this rhltable under the table hierarchy fixes this issue.

8) Reject invalid combined usage of hashlimit tables with and without XT_HASHLIMIT_RATE_MATCH flag mode, otherwise access to uninitialized .burst field of dsthash_ent is possible.

9) Fix checksum validations in IPVS performed from LOCAL_IN, from Julian Anastasov.

10) Fix incorrect packet offset to layer 4 protocol in IPVS, uncovered by Sashiko, from Julian Anastasov.

11) Skip the mangling of ICMP replies for non-first fragments, also reported by Sashiko. Also from Julian.

12) Clear ip_vs_conn flags under the spinlock to fix a possible data race. From Julian Anastasov.

13) Fix incorrect calculation of the payload bitmask in the nf_tables hardware offload support, leading to UBSAN splat. From Xiang Mei.

Julian Anastasov clarifies that some of the IPVS patches might still result in pre-existing issues reports by Sashiko, they are ready to follow up on that.

Please, pull these changes from:

git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-07-22

Thanks.

----------------------------------------------------------------

The following changes since commit fca68249b6f5e84859b200b54cb5e0aef98f2b3a:

Merge branch 'net-fix-two-issues-in-sk_clone-error-path' (2026-07-21 09:15:01 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-07-22

for you to fetch changes up to 09e0d3e6d4f401e8216227657d5e412553785607:

netfilter: nft_payload: fix mask build for partial field offload (2026-07-22 20:47:50 +0200)

----------------------------------------------------------------
netfilter pull request 26-07-22

----------------------------------------------------------------
David Lee (1):
netfilter: ipset: do not update comments from kernel-side hash adds

Julian Anastasov (5):
ipvs: adjust double hashing when fwd method changes
ipvs: fix the checksum validations
ipvs: fix places with wrong packet offsets
ipvs: do not mangle ICMP replies for non-first fragments
ipvs: clear the nfct flag under lock

Lorenzo Bianconi (1):
selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests

Pablo Neira Ayuso (3):
netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
netfilter: nf_tables: make nft_object rhltable per table
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Xiang Mei (1):
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Xiang Mei (Microsoft) (1):
netfilter: nft_payload: fix mask build for partial field offload

Zhiling Zou (1):
ipvs: do not propagate one-packet flag to synced conns

 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/net/ip_vs.h                                |  48 +++++-
 include/net/netfilter/nf_conntrack_expect.h        |   3 +
 include/net/netfilter/nf_tables.h                  |   4 +-
 net/ipv4/netfilter/nf_nat_h323.c                   |  22 +--
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    | 192 ++++++++++++++++-----
 net/netfilter/ipvs/ip_vs_core.c                    | 190 ++++++++++----------
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  19 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  48 ++----
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 ++----
 net/netfilter/ipvs/ip_vs_xmit.c                    |  42 +++--
 net/netfilter/nf_conntrack_expect.c                |  35 +++-
 net/netfilter/nf_conntrack_sip.c                   |   2 +-
 net/netfilter/nf_nat_sip.c                         |  22 +--
 net/netfilter/nf_tables_api.c                      |  34 ++--
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 .../selftests/net/netfilter/nft_flowtable.sh       |  14 +-
 20 files changed, 452 insertions(+), 313 deletions(-)