Commit 5d672e3c authored by Florian Westphal's avatar Florian Westphal Committed by Zhang Changzhong
Browse files

netfilter: nf_set_pipapo: fix initial map fill 

mainline inclusion
from mainline-v6.11-rc1
commit 791a615b7ad2258c560f91852be54b0480837c93
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJKDJ
CVE: CVE-2024-57947

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=791a615b7ad2258c560f91852be54b0480837c93



--------------------------------

The initial buffer has to be inited to all-ones, but it must restrict
it to the size of the first field, not the total field size.

After each round in the map search step, the result and the fill map
are swapped, so if we have a set where f->bsize of the first element
is smaller than m->bsize_max, those one-bits are leaked into future
rounds result map.

This makes pipapo find an incorrect matching results for sets where
first field size is not the largest.

Followup patch adds a test case to nft_concat_range.sh selftest script.

Thanks to Stefano Brivio for pointing out that we need to zero out
the remainder explicitly, only correcting memset() argument isn't enough.

Fixes: 3c4287f6 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: default avatarYi Chen <yiche@redhat.com>
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Conflicts:
	net/netfilter/nft_set_pipapo_avx2.c
[commit f04df573faf9 ("netfilter: nft_set_pipapo: constify lookup fn
args where possible") not merged]
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 22f72139

net/netfilter/nft_set_pipapo.c

+2 −2
Original line number Diff line number Diff line
@@ -432,7 +432,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, 
	res_map  = scratch->map + (map_index ? m->bsize_max : 0);

	fill_map = scratch->map + (map_index ? 0 : m->bsize_max);



	memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));

	pipapo_resmap_init(m, res_map);



	nft_pipapo_for_each_field(f, i, m) {

		bool last = i == m->field_count - 1;
@@ -536,7 +536,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, 
		goto out;

	}



	memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));

	pipapo_resmap_init(m, res_map);



	nft_pipapo_for_each_field(f, i, m) {

		bool last = i == m->field_count - 1;

net/netfilter/nft_set_pipapo.h

+21 −0
Original line number Diff line number Diff line
@@ -287,4 +287,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc) 
	return size;

}



/**

 * pipapo_resmap_init() - Initialise result map before first use

 * @m:		Matching data, including mapping table

 * @res_map:	Result map

 *

 * Initialize all bits covered by the first field to one, so that after

 * the first step, only the matching bits of the first bit group remain.

 *

 * If other fields have a large bitmap, set remainder of res_map to 0.

 */

static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map)

{

	const struct nft_pipapo_field *f = m->f;

	int i;



	for (i = 0; i < f->bsize; i++)

		res_map[i] = ULONG_MAX;



	for (i = f->bsize; i < m->bsize_max; i++)

		res_map[i] = 0ul;

}

#endif /* _NFT_SET_PIPAPO_H */

net/netfilter/nft_set_pipapo_avx2.c

+6 −4
Original line number Diff line number Diff line
@@ -1027,6 +1027,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, 


/**

 * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes

 * @mdata:	Matching data, including mapping table

 * @map:	Previous match result, used as initial bitmap

 * @fill:	Destination bitmap to be filled with current match result

 * @f:		Field, containing lookup and mapping tables
@@ -1042,7 +1043,8 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, 
 * Return: -1 on no match, rule index of match if @last, otherwise first long

 * word index to be checked next (i.e. first filled word).

 */

static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,

static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata,

					unsigned long *map, unsigned long *fill,

					struct nft_pipapo_field *f, int offset,

					const u8 *pkt, bool first, bool last)

{
@@ -1052,7 +1054,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, 
	lt += offset * NFT_PIPAPO_LONGS_PER_M256;



	if (first)

		memset(map, 0xff, bsize * sizeof(*map));

		pipapo_resmap_init(mdata, map);



	for (i = offset; i < bsize; i++) {

		if (f->bb == 8)
@@ -1173,7 +1175,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, 
			} else if (f->groups == 16) {

				NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16);

			} else {

				ret = nft_pipapo_avx2_lookup_slow(res, fill, f,

				ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,

								  ret, rp,

								  first, last);

			}
@@ -1189,7 +1191,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, 
			} else if (f->groups == 32) {

				NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32);

			} else {

				ret = nft_pipapo_avx2_lookup_slow(res, fill, f,

				ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,

								  ret, rp,

								  first, last);

			}