Yuan Tan 329f0b9b48 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels ... IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer. If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1. Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type. Fixes: 68983a354a ("netfilter: xtables: Add snapshot of hardidletimer target") Co-developed-by: Yifan Wu <yifanwucs@gmail.com> Signed-off-by: Yifan Wu <yifanwucs@gmail.com> Co-developed-by: Juefei Pu <tomapufckgml@gmail.com> Signed-off-by: Juefei Pu <tomapufckgml@gmail.com> Signed-off-by: Yuan Tan <tanyuan98@outlook.com> Signed-off-by: Xin Liu <dstsmallbird@foxmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>		2026-03-10 14:10:43 +01:00
..
ipset	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
ipvs	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
Kconfig	…
Makefile	netfilter: flowtable: move path discovery infrastructure to its own file	2025-11-27 23:59:43 +00:00
core.c	…
nf_bpf_link.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nf_conncount.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_conntrack_acct.c	…
nf_conntrack_amanda.c	netfilter: annotate NAT helper hook pointers with __rcu	2026-02-17 15:04:20 +01:00
nf_conntrack_bpf.c	Networking changes for 7.0	2026-02-11 19:31:52 -08:00
nf_conntrack_broadcast.c	…
nf_conntrack_core.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_conntrack_ecache.c	net: replace use of system_wq with system_percpu_wq	2025-09-22 17:40:30 -07:00
nf_conntrack_expect.c	…
nf_conntrack_extend.c	…
nf_conntrack_ftp.c	netfilter: annotate NAT helper hook pointers with __rcu	2026-02-17 15:04:20 +01:00
nf_conntrack_h323_asn1.c	netfilter: nf_conntrack_h323: fix OOB read in decode_choice()	2026-02-26 12:50:42 +01:00
nf_conntrack_h323_main.c	netfilter: nf_conntrack_h323: don't pass uninitialised l3num value	2026-02-17 15:04:20 +01:00
nf_conntrack_h323_types.c	…
nf_conntrack_helper.c	netfilter: conntrack: helper: Replace -EEXIST by -EBUSY	2025-08-27 11:53:38 +02:00
nf_conntrack_irc.c	netfilter: annotate NAT helper hook pointers with __rcu	2026-02-17 15:04:20 +01:00
nf_conntrack_labels.c	…
nf_conntrack_netbios_ns.c	…
nf_conntrack_netlink.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_conntrack_ovs.c	net/ipv6: Introduce payload_len helpers	2026-02-06 20:50:03 -08:00
nf_conntrack_pptp.c	…
nf_conntrack_proto.c	…
nf_conntrack_proto_generic.c	netfilter: nf_conntrack: Add allow_clash to generic protocol handler	2026-01-20 16:23:37 +01:00
nf_conntrack_proto_gre.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nf_conntrack_proto_icmp.c	netfilter: nf_conntrack: enable icmp clash support	2026-01-20 16:23:37 +01:00
nf_conntrack_proto_icmpv6.c	netfilter: nf_conntrack: enable icmp clash support	2026-01-20 16:23:37 +01:00
nf_conntrack_proto_sctp.c	…
nf_conntrack_proto_tcp.c	…
nf_conntrack_proto_udp.c	…
nf_conntrack_sane.c	…
nf_conntrack_seqadj.c	…
nf_conntrack_sip.c	…
nf_conntrack_snmp.c	netfilter: annotate NAT helper hook pointers with __rcu	2026-02-17 15:04:20 +01:00
nf_conntrack_standalone.c	netfilter: conntrack: disable 0 value for conntrack_max setting	2025-10-30 12:52:45 +01:00
nf_conntrack_tftp.c	netfilter: annotate NAT helper hook pointers with __rcu	2026-02-17 15:04:20 +01:00
nf_conntrack_timeout.c	…
nf_conntrack_timestamp.c	…
nf_dup_netdev.c	…
nf_flow_table_bpf.c	bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs	2026-01-02 12:04:28 -08:00
nf_flow_table_core.c	netfilter: flowtable: dedicated slab for flow entry	2026-02-06 13:34:55 +01:00
nf_flow_table_inet.c	…
nf_flow_table_ip.c	netfilter: flowtable: Add IP6IP6 tx sw acceleration	2026-01-29 09:52:06 +01:00
nf_flow_table_offload.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_flow_table_path.c	netfilter: nf_conntrack: don't rely on implicit includes	2026-01-20 16:23:37 +01:00
nf_flow_table_procfs.c	…
nf_flow_table_xdp.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nf_hooks_lwtunnel.c	…
nf_internals.h	…
nf_log.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nf_log_syslog.c	net/ipv6: Introduce payload_len helpers	2026-02-06 20:50:03 -08:00
nf_nat_amanda.c	…
nf_nat_bpf.c	bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs	2026-01-02 12:04:28 -08:00
nf_nat_core.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_nat_ftp.c	…
nf_nat_helper.c	…
nf_nat_irc.c	…
nf_nat_masquerade.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nf_nat_ovs.c	netfilter: nf_conntrack: don't rely on implicit includes	2026-01-20 16:23:37 +01:00
nf_nat_proto.c	netfilter: nf_conntrack: don't rely on implicit includes	2026-01-20 16:23:37 +01:00
nf_nat_redirect.c	…
nf_nat_sip.c	…
nf_nat_tftp.c	…
nf_queue.c	…
nf_sockopt.c	…
nf_synproxy_core.c	netfilter: don't include xt and nftables.h in unrelated subsystems	2026-01-20 16:23:37 +01:00
nf_tables_api.c	netfilter: nf_tables: always walk all pending catchall elements	2026-03-10 14:10:42 +01:00
nf_tables_core.c	…
nf_tables_offload.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nf_tables_trace.c	…
nfnetlink.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nfnetlink_acct.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nfnetlink_cthelper.c	netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()	2026-03-10 14:10:42 +01:00
nfnetlink_cttimeout.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nfnetlink_hook.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nfnetlink_log.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nfnetlink_osf.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nfnetlink_queue.c	netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path	2026-03-10 14:10:42 +01:00
nft_bitwise.c	…
nft_byteorder.c	…
nft_chain_filter.c	netfilter: nf_tables: Fix for duplicate device in netdev hooks	2026-03-10 14:10:42 +01:00
nft_chain_nat.c	…
nft_chain_route.c	…
nft_cmp.c	…
nft_compat.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_connlimit.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_counter.c	netfilter: nft_counter: serialize reset with spinlock	2026-02-17 15:04:20 +01:00
nft_ct.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nft_ct_fast.c	…
nft_dup_netdev.c	…
nft_dynset.c	…
nft_exthdr.c	…
nft_fib.c	…
nft_fib_inet.c	…
nft_fib_netdev.c	…
nft_flow_offload.c	netfilter: nf_conntrack: don't rely on implicit includes	2026-01-20 16:23:37 +01:00
nft_fwd_netdev.c	…
nft_hash.c	…
nft_immediate.c	…
nft_inner.c	…
nft_last.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_limit.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_log.c	audit: add audit_log_nf_skb helper function	2025-12-16 11:04:14 -05:00
nft_lookup.c	netfilter: nf_tables: use C99 struct initializer for nft_set_iter	2025-10-30 12:52:45 +01:00
nft_masq.c	…
nft_meta.c	…
nft_nat.c	…
nft_numgen.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_objref.c	netfilter: nft_objref: validate objref and objrefmap expressions	2025-10-08 13:17:25 +02:00
nft_osf.c	…
nft_payload.c	netfilter: nft_payload: extend offset to 65535 bytes	2025-09-02 15:28:18 +02:00
nft_queue.c	…
nft_quota.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
nft_range.c	…
nft_redir.c	…
nft_reject.c	…
nft_reject_inet.c	…
nft_reject_netdev.c	…
nft_rt.c	…
nft_set_bitmap.c	netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation	2025-09-10 20:28:24 +02:00
nft_set_hash.c	netfilter: nf_tables: clone set on flush only	2026-03-05 13:22:37 +01:00
nft_set_pipapo.c	netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()	2026-03-10 14:10:42 +01:00
nft_set_pipapo.h	netfilter: nft_set_pipapo: split gc into unlink and reclaim phase	2026-03-05 13:22:37 +01:00
nft_set_pipapo_avx2.c	netfilter: nft_set_pipapo_avx2: fix skip of expired entries	2025-09-24 11:50:28 +02:00
nft_set_pipapo_avx2.h	netfilter: nft_set_pipapo: use avx2 algorithm for insertions too	2025-08-20 13:52:37 +02:00
nft_set_rbtree.c	netfilter: nf_tables: clone set on flush only	2026-03-05 13:22:37 +01:00
nft_socket.c	netfilter: nft_socket: remove WARN_ON_ONCE with huge level value	2025-08-07 13:19:26 +02:00
nft_synproxy.c	netfilter: don't include xt and nftables.h in unrelated subsystems	2026-01-20 16:23:37 +01:00
nft_tproxy.c	…
nft_tunnel.c	…
nft_xfrm.c	…
utils.c	…
x_tables.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_AUDIT.c	audit: add audit_log_nf_skb helper function	2025-12-16 11:04:14 -05:00
xt_CHECKSUM.c	…
xt_CLASSIFY.c	…
xt_CONNSECMARK.c	…
xt_CT.c	…
xt_DSCP.c	…
xt_HL.c	…
xt_HMARK.c	…
xt_IDLETIMER.c	netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels	2026-03-10 14:10:43 +01:00
xt_LED.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_LOG.c	…
xt_MASQUERADE.c	…
xt_NETMAP.c	…
xt_NFLOG.c	…
xt_NFQUEUE.c	…
xt_RATEEST.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_REDIRECT.c	…
xt_SECMARK.c	…
xt_TCPMSS.c	…
xt_TCPOPTSTRIP.c	…
xt_TEE.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_TPROXY.c	…
xt_TRACE.c	…
xt_addrtype.c	…
xt_bpf.c	…
xt_cgroup.c	…
xt_cluster.c	…
xt_comment.c	…
xt_connbytes.c	…
xt_connlabel.c	…
xt_connlimit.c	netfilter: nf_conncount: rework API to use sk_buff directly	2025-11-28 00:05:49 +00:00
xt_connmark.c	…
xt_conntrack.c	…
xt_cpu.c	…
xt_dccp.c	netfilter: x_tables: guard option walkers against 1-byte tail reads	2026-03-10 14:10:42 +01:00
xt_devgroup.c	…
xt_dscp.c	…
xt_ecn.c	…
xt_esp.c	…
xt_hashlimit.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_helper.c	…
xt_hl.c	…
xt_ipcomp.c	…
xt_iprange.c	…
xt_ipvs.c	…
xt_l2tp.c	…
xt_length.c	…
xt_limit.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_mac.c	…
xt_mark.c	…
xt_multiport.c	…
xt_nat.c	…
xt_nfacct.c	…
xt_osf.c	…
xt_owner.c	…
xt_physdev.c	…
xt_pkttype.c	…
xt_policy.c	…
xt_quota.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_rateest.c	…
xt_realm.c	…
xt_recent.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_repldata.h	…
xt_sctp.c	…
xt_set.c	…
xt_socket.c	…
xt_state.c	…
xt_statistic.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
xt_string.c	…
xt_tcpmss.c	netfilter: xt_tcpmss: check remaining length before reading optlen	2026-01-20 16:23:38 +01:00
xt_tcpudp.c	netfilter: x_tables: guard option walkers against 1-byte tail reads	2026-03-10 14:10:42 +01:00
xt_time.c	netfilter: xt_time: use is_leap_year() helper	2026-01-29 09:52:07 +01:00
xt_u32.c	…