Re: [PATCH nf v2] netfilter: nft_bitwise: fix dst corruption in same register shifts

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> In nft_bitwise_eval_lshift() and nft_bitwise_eval_rshift(), shift
> operations are performed in a loop over 32-bit words. The loop
> calculates the shifted value, writes it to dst, and calculates the carry
> from src for the next iteration.
> 
> If the source and destination registers overlap either exactly (sreg ==
> dreg) or partially (e.g., dreg is offset from sreg by 4 bytes) the loop
> overwrites src data before it can be read by subsequent iterations. This
> causes the carry or the shifted data itself to be incorrectly calculated
> using the newly modified dst value instead of the original src payload.

We should support overlaps (src == dst).  But partial overlaps?
Does nft generate such byte code?

I think we should reject it.  Either userspace has no more use
for src (and can clobber it with the shifted result), or it has
to keep it for later reuse.  But in what case is a partially clobbered
register useful?