diff options
| author | Florian Westphal <[email protected]> | 2025-04-07 17:40:18 +0000 |
|---|---|---|
| committer | Pablo Neira Ayuso <[email protected]> | 2025-04-10 10:33:50 +0000 |
| commit | e042ed950d4e176379ba4c0722146cd96fb38aa2 (patch) | |
| tree | e6d278f77be814e294fe1b49952968c28165aa07 /drivers/net/ethernet/intel/igc/igc_main.c | |
| parent | net: ppp: Add bound checking for skb data on ppp_sync_txmung (diff) | |
| download | kernel-e042ed950d4e176379ba4c0722146cd96fb38aa2.tar.gz kernel-e042ed950d4e176379ba4c0722146cd96fb38aa2.zip | |
nft_set_pipapo: fix incorrect avx2 match of 5th field octet
Given a set element like:
icmpv6 . dead:beef:00ff::1
The value of 'ff' is irrelevant, any address will be matched
as long as the other octets are the same.
This is because of too-early register clobbering:
ymm7 is reloaded with new packet data (pkt[9]) but it still holds data
of an earlier load that wasn't processed yet.
The existing tests in nft_concat_range.sh selftests do exercise this code
path, but do not trigger incorrect matching due to the network prefix
limitation.
Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Reported-by: sontu mazumdar <[email protected]>
Closes: https://lore.kernel.org/netfilter/CANgxkqwnMH7fXra+VUfODT-8+qFLgskq3set1cAzqqJaV4iEZg@mail.gmail.com/T/#t
Reviewed-by: Stefano Brivio <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
Diffstat (limited to 'drivers/net/ethernet/intel/igc/igc_main.c')
0 files changed, 0 insertions, 0 deletions