Commit e042ed95 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

nft_set_pipapo: fix incorrect avx2 match of 5th field octet 



Given a set element like:

	icmpv6 . dead:beef:00ff::1

The value of 'ff' is irrelevant, any address will be matched
as long as the other octets are the same.

This is because of too-early register clobbering:
ymm7 is reloaded with new packet data (pkt[9])  but it still holds data
of an earlier load that wasn't processed yet.

The existing tests in nft_concat_range.sh selftests do exercise this code
path, but do not trigger incorrect matching due to the network prefix
limitation.

Fixes: 7400b063 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Reported-by: default avatarsontu mazumdar <sontu21@gmail.com>
Closes: https://lore.kernel.org/netfilter/CANgxkqwnMH7fXra+VUfODT-8+qFLgskq3set1cAzqqJaV4iEZg@mail.gmail.com/T/#t


Reviewed-by: default avatarStefano Brivio <sbrivio@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent aabc6596

net/netfilter/nft_set_pipapo_avx2.c

+2 −1
Original line number Diff line number Diff line
@@ -994,8 +994,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, 
		NFT_PIPAPO_AVX2_BUCKET_LOAD8(5, lt,  8,  pkt[8], bsize);



		NFT_PIPAPO_AVX2_AND(6, 2, 3);

		NFT_PIPAPO_AVX2_AND(3, 4, 7);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(7, lt,  9,  pkt[9], bsize);

		NFT_PIPAPO_AVX2_AND(0, 4, 5);

		NFT_PIPAPO_AVX2_AND(0, 3, 5);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(1, lt, 10, pkt[10], bsize);

		NFT_PIPAPO_AVX2_AND(2, 6, 7);

		NFT_PIPAPO_AVX2_BUCKET_LOAD8(3, lt, 11, pkt[11], bsize);