From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9EAC238D49; Tue, 17 Jun 2025 16:27:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750177648; cv=none; b=aBHLOm60vNkIZsD6JXrDWKDGRx8qGlr/UMdpmbE0GaO3EnSZONuh/pkhR11rR72htq+df8Ia1+6IVpZn4YcnVlMXgSs8BvRDmISvBTmB9wrIKghsWvTVM69LPNNDV0oGfEr4s15z/AbbGLhxNvF1x19a7KSJ74wjSN3+BeDPNbs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750177648; c=relaxed/simple; bh=Dw+gQgxpq2X5+yja5dprg0m8epPOcjibkabPTD3Ip3o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PRQHPmksmnNhoQhShjoJ8BLZE+0LLdy1ND9Uj8EgTNcaQje5lKb+Ht/WR/4JIFyigH6ieCi6f4eixW1QI2xNmCbe4KkYN40lD2gDFHAKG4YWw0okDKr4C/6qG5Ro2rsL0+uxutUKzZcKERPjkw5ZdKbj8zrvsMVuBXRnKxZexNQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w2CeGPd5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="w2CeGPd5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 594C5C4CEE3; Tue, 17 Jun 2025 16:27:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1750177648; bh=Dw+gQgxpq2X5+yja5dprg0m8epPOcjibkabPTD3Ip3o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w2CeGPd5k5cm/bSXJ4hUHc3ROjoHFmgq1hF4UTelqs6S9x+usRqw1addcnpGQsdwI ns/NiCEeAm9PsclHgRYp6fz7Wf9rkevkd2RcAB78ffWLyfBHcbycU1g2nDpSUAsau6 fGfsPCE2Of91fIDDp26CV2/k8Bq1tfKaWNsRoo/c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Florian Westphal , Stefano Brivio , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.12 376/512] netfilter: nf_set_pipapo_avx2: fix initial map fill Date: Tue, 17 Jun 2025 17:25:42 +0200 Message-ID: <20250617152434.828290764@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250617152419.512865572@linuxfoundation.org> References: <20250617152419.512865572@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal [ Upstream commit ea77c397bff8b6d59f6d83dae1425b08f465e8b5 ] If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. Fixes: 791a615b7ad2 ("netfilter: nf_set_pipapo: fix initial map fill") Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nft_set_pipapo_avx2.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c index c15db28c5ebc4..be7c16c79f711 100644 --- a/net/netfilter/nft_set_pipapo_avx2.c +++ b/net/netfilter/nft_set_pipapo_avx2.c @@ -1113,6 +1113,25 @@ bool nft_pipapo_avx2_estimate(const struct nft_set_desc *desc, u32 features, return true; } +/** + * pipapo_resmap_init_avx2() - Initialise result map before first use + * @m: Matching data, including mapping table + * @res_map: Result map + * + * Like pipapo_resmap_init() but do not set start map bits covered by the first field. + */ +static inline void pipapo_resmap_init_avx2(const struct nft_pipapo_match *m, unsigned long *res_map) +{ + const struct nft_pipapo_field *f = m->f; + int i; + + /* Starting map doesn't need to be set to all-ones for this implementation, + * but we do need to zero the remaining bits, if any. + */ + for (i = f->bsize; i < m->bsize_max; i++) + res_map[i] = 0ul; +} + /** * nft_pipapo_avx2_lookup() - Lookup function for AVX2 implementation * @net: Network namespace @@ -1171,7 +1190,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, res = scratch->map + (map_index ? m->bsize_max : 0); fill = scratch->map + (map_index ? 0 : m->bsize_max); - /* Starting map doesn't need to be set for this implementation */ + pipapo_resmap_init_avx2(m, res); nft_pipapo_avx2_prepare(); -- 2.39.5