Re: linux-next: manual merge of the bluetooth-fixes tree with the net tree

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

@netdev maintainers: Please, see below.

On Wed, Oct 21, 2026 at 12:01:41PM +0100, Mark Brown wrote:
> Hi all,
> 
> Today's linux-next merge of the bluetooth-fixes tree got a conflict in:
> 
>   net/netfilter/nf_conntrack_netlink.c
> 
> between commit:
> 
>   cd37ab22a74e0 ("netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter")
> 
> from the net tree and commit:
> 
>   1ae2d094b0200 ("netfilter: ctnetlink: fix inverted IPv6 address match in dump filter")
> 
> from the bluetooth-fixes tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.

Sorry for this: This patch is duplicated, one variant went into
net.git and another into net-next.git.

Two possibilities:

- Revert 1ae2d094b020 ("netfilter: ctnetlink: fix inverted IPv6
  address match in dump filter") in net-next.git

or

- Revert cd37ab22a74e ("netfilter: nf_conntrack_netlink: fix inverted
  IPv6 tuple filter")

before net-next.git gets merged into net.git, because these two
patches address the same issue.

Apologies for this.

> diff --combined net/netfilter/nf_conntrack_netlink.c
> index cc8695d5356d2,4b6abe36028e3..0000000000000
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@@ -911,6 -911,7 +911,7 @@@ struct ctnetlink_filter 
>   static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = {
>   	[CTA_FILTER_ORIG_FLAGS]		= NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
>   	[CTA_FILTER_REPLY_FLAGS]	= NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
> + 	[CTA_FILTER_ZONE]		= { .type = NLA_FLAG },
>   };
>   
>   static int ctnetlink_parse_filter(const struct nlattr *attr,
> @@@ -930,6 -931,9 +931,9 @@@
>   	if (tb[CTA_FILTER_REPLY_FLAGS])
>   		filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]);
>   
> + 	if (tb[CTA_FILTER_ZONE])
> + 		filter->zone_filter = true;
> + 
>   	return 0;
>   }
>   
> @@@ -1006,6 -1010,7 +1010,7 @@@ ctnetlink_alloc_filter(const struct nla
>   	if (err)
>   		goto err_filter;
>   
> + 	/* CTA_ZONE is allowed without CTA_FILTER_ZONE. */
>   	if (cda[CTA_ZONE]) {
>   		err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);
>   		if (err < 0)
> @@@ -1020,6 -1025,12 +1025,12 @@@
>   	if (err < 0)
>   		goto err_filter;
>   
> + 	/* CTA_FILTER_ZONE cannot be set without CTA_ZONE. */
> + 	if (filter->zone_filter && !cda[CTA_ZONE]) {
> + 		err = -EINVAL;
> + 		goto err_filter;
> + 	}
> + 
>   	if (filter->orig_flags) {
>   		if (!cda[CTA_TUPLE_ORIG]) {
>   			err = -EINVAL;
> @@@ -1098,13 -1109,13 +1109,13 @@@ static int ctnetlink_filter_match_tuple
>   		break;
>   	case NFPROTO_IPV6:
>   		if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) &&
> - 		    ipv6_addr_cmp(&filter_tuple->src.u3.in6,
> - 				  &ct_tuple->src.u3.in6))
> + 		    !ipv6_addr_equal(&filter_tuple->src.u3.in6,
> + 				     &ct_tuple->src.u3.in6))
>   			return 0;
>   
>   		if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) &&
> - 		    ipv6_addr_cmp(&filter_tuple->dst.u3.in6,
> - 				  &ct_tuple->dst.u3.in6))
> + 		    !ipv6_addr_equal(&filter_tuple->dst.u3.in6,
> + 				     &ct_tuple->dst.u3.in6))
>   			return 0;
>   		break;
>   	}