kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,076,379 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Fernando Fernandez Mancera 53bc0ac47f netfilter: nft_connlimit: update the count if add was skipped 
[ Upstream commit 69894e5b4c ]

Connlimit expression can be used for all kind of packets and not only
for packets with connection state new. See this ruleset as example:

table ip filter {
        chain input {
                type filter hook input priority filter; policy accept;
                tcp dport 22 ct count over 4 counter
        }
}

Currently, if the connection count goes over the limit the counter will
count the packets. When a connection is closed, the connection count
won't decrement as it should because it is only updated for new
connections due to an optimization on __nf_conncount_add() that prevents
updating the list if the connection is duplicated.

To solve this problem, check whether the connection was skipped and if
so, update the list. Adjust count_tree() too so the same fix is applied
for xt_connlimit.

Fixes: 976afca1ce ("netfilter: nf_conncount: Early exit in nf_conncount_lookup() and cleanup")
Closes: https://lore.kernel.org/netfilter/trinity-85c72a88-d762-46c3-be97-36f10e5d9796-1761173693813@3c-app-mailcom-bs12/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-19 13:09:35 +01:00
arch powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format 2026-01-19 13:09:30 +01:00
block Revert "block: don't add or resize partition on the disk with GENHD_FL_NO_PART" 2025-12-07 06:09:33 +09:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id 2026-01-19 13:09:24 +01:00
Documentation dt-bindings: PCI: amlogic: Fix the register name of the DBI region 2026-01-19 13:09:27 +01:00
drivers regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex 2026-01-19 13:09:35 +01:00
fs ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation 2026-01-19 13:09:34 +01:00
include netfilter: nf_conncount: rework API to use sk_buff directly 2026-01-19 13:09:35 +01:00
init init: handle bootloader identifier in kernel parameters 2025-10-19 16:21:45 +02:00
io_uring io_uring: fix possible deadlock in io_register_iowq_max_workers() 2024-11-17 15:06:25 +01:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:05:26 +01:00
kernel locking/spinlock/debug: Fix data-race in do_raw_write_lock 2026-01-19 13:09:19 +01:00
lib lib/vsprintf: Check pointer before dereferencing in time_and_date() 2026-01-19 13:09:29 +01:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/secretmem: fix use-after-free race in fault handler 2025-12-07 06:09:32 +09:00
net netfilter: nft_connlimit: update the count if add was skipped 2026-01-19 13:09:35 +01:00
samples samples: mei: Fix building on musl libc 2025-08-28 16:24:07 +02:00
scripts Makefile.compiler: replace cc-ifversion with compiler-specific macros 2025-12-07 06:09:32 +09:00
security ima: Handle error code returned by ima_filter_rule_match() 2026-01-19 13:09:31 +01:00
sound ASoC: Intel: catpt: Fix error path in hw_params() 2026-01-19 13:09:35 +01:00
tools selftests/bpf: Improve reliability of test_perf_branches_no_hw() 2026-01-19 13:09:32 +01:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-10-22 15:40:41 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.197 2025-12-07 06:09:37 +09:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.