diff options
| author |   Florian Westphal <fw@strlen.de> | 2025-04-07 19:40:18 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2025-04-10 12:33:50 +0200 |
| commit | e042ed950d4e176379ba4c0722146cd96fb38aa2 (patch) | |
| tree | e6d278f77be814e294fe1b49952968c28165aa07 /net/unix/af_unix.c | |
| parent | net: ppp: Add bound checking for skb data on ppp_sync_txmung (diff) | |
| download | wireguard-linux-e042ed950d4e176379ba4c0722146cd96fb38aa2.tar.xz wireguard-linux-e042ed950d4e176379ba4c0722146cd96fb38aa2.zip | |
nft_set_pipapo: fix incorrect avx2 match of 5th field octet
Given a set element like:
icmpv6 . dead:beef:00ff::1
The value of 'ff' is irrelevant, any address will be matched
as long as the other octets are the same.
This is because of too-early register clobbering:
ymm7 is reloaded with new packet data (pkt[9]) but it still holds data
of an earlier load that wasn't processed yet.
The existing tests in nft_concat_range.sh selftests do exercise this code
path, but do not trigger incorrect matching due to the network prefix
limitation.
Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Reported-by: sontu mazumdar <sontu21@gmail.com>
Closes: https://lore.kernel.org/netfilter/CANgxkqwnMH7fXra+VUfODT-8+qFLgskq3set1cAzqqJaV4iEZg@mail.gmail.com/T/#t
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions