netfilter: nf_set_pipapo: fix initial map fill

The initial buffer has to be inited to all-ones, but it must restrict
it to the size of the first field, not the total field size.

After each round in the map search step, the result and the fill map
are swapped, so if we have a set where f->bsize of the first element
is smaller than m->bsize_max, those one-bits are leaked into future
rounds result map.

This makes pipapo find an incorrect matching results for sets where
first field size is not the largest.

Followup patch adds a test case to nft_concat_range.sh selftest script.

Thanks to Stefano Brivio for pointing out that we need to zero out
the remainder explicitly, only correcting memset() argument isn't enough.

Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Yi Chen <yiche@redhat.com>
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 15a236bebb46a06523e2473d0acd7fab08135acb..eb4c4a4ac7acea12b213b8db8826930b20a854a6 100644 (file)
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -434,7 +434,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
        res_map  = scratch->map + (map_index ? m->bsize_max : 0);
        fill_map = scratch->map + (map_index ? 0 : m->bsize_max);
 
-       memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+       pipapo_resmap_init(m, res_map);
 
        nft_pipapo_for_each_field(f, i, m) {
                bool last = i == m->field_count - 1;
@@ -542,7 +542,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net,
                goto out;
        }
 
-       memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+       pipapo_resmap_init(m, res_map);
 
        nft_pipapo_for_each_field(f, i, m) {
                bool last = i == m->field_count - 1;

diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h
index 0d2e40e10f7f577ef317a985d2fa12520bb43a4a..4a2ff85ce1c435b01d3bc7e1219476667c4911c4 100644 (file)
--- a/net/netfilter/nft_set_pipapo.h
+++ b/net/netfilter/nft_set_pipapo.h
@@ -278,4 +278,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc)
        return size;
 }
 
+/**
+ * pipapo_resmap_init() - Initialise result map before first use
+ * @m:         Matching data, including mapping table
+ * @res_map:   Result map
+ *
+ * Initialize all bits covered by the first field to one, so that after
+ * the first step, only the matching bits of the first bit group remain.
+ *
+ * If other fields have a large bitmap, set remainder of res_map to 0.
+ */
+static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map)
+{
+       const struct nft_pipapo_field *f = m->f;
+       int i;
+
+       for (i = 0; i < f->bsize; i++)
+               res_map[i] = ULONG_MAX;
+
+       for (i = f->bsize; i < m->bsize_max; i++)
+               res_map[i] = 0ul;
+}
 #endif /* _NFT_SET_PIPAPO_H */

diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c
index d08407d589eac54b10e4b4cc107e25adc875e9e2..8910a5ac7ed12243794831fb1bf105f08f727c96 100644 (file)
--- a/net/netfilter/nft_set_pipapo_avx2.c
+++ b/net/netfilter/nft_set_pipapo_avx2.c
@@ -1036,6 +1036,7 @@ nothing:
 
 /**
  * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes
+ * @mdata:     Matching data, including mapping table
  * @map:       Previous match result, used as initial bitmap
  * @fill:      Destination bitmap to be filled with current match result
  * @f:         Field, containing lookup and mapping tables
@@ -1051,7 +1052,8 @@ nothing:
  * Return: -1 on no match, rule index of match if @last, otherwise first long
  * word index to be checked next (i.e. first filled word).
  */
-static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,
+static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata,
+                                       unsigned long *map, unsigned long *fill,
                                        const struct nft_pipapo_field *f,
                                        int offset, const u8 *pkt,
                                        bool first, bool last)
@@ -1060,7 +1062,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,
        int i, ret = -1, b;
 
        if (first)
-               memset(map, 0xff, bsize * sizeof(*map));
+               pipapo_resmap_init(mdata, map);
 
        for (i = offset; i < bsize; i++) {
                if (f->bb == 8)
@@ -1186,7 +1188,7 @@ next_match:
                        } else if (f->groups == 16) {
                                NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16);
                        } else {
-                               ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+                               ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
                                                                  ret, rp,
                                                                  first, last);
                        }
@@ -1202,7 +1204,7 @@ next_match:
                        } else if (f->groups == 32) {
                                NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32);
                        } else {
-                               ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+                               ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
                                                                  ret, rp,
                                                                  first, last);
                        }