github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-15 14:47:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
1,384,663 Commits 1 Branch 953 Tags 16 GiB
C 96.8%
Assembly 0.9%
Rust 0.7%
Shell 0.6%
Python 0.5%
Other 0.3%
5823699a11
Go to file
Florian Westphal 5823699a11 netfilter: nft_set_pipapo_avx2: fix skip of expired entries 
KASAN reports following splat:
BUG: KASAN: slab-out-of-bounds in pipapo_get_avx2+0x941/0x25d0
Read of size 1 at addr ffff88814c561be0 by task nft/3944
Call Trace:
 pipapo_get_avx2+0x941/0x25d0
 nft_pipapo_insert+0x440/0x11b0
 nf_tables_newsetelem+0x220a/0x3a00
 ..

This bisects to commit 84c1da7b38 ("netfilter: nft_set_pipapo: use AVX2
algorithm for insertions too").

However, that change merely uncovers this bug.

When we find a match but that match has expired or timed out, the AVX2
implementation restarts the full match loop.

At that point, the pointer to the key data has already been changed and
points to the keys last field.
This will then result in out-of-bounds read once its incremented again
for the next field.

The restart logic in AVX2 is different compared to the plain C
implementation, but both should follow the same logic.

The C implementation just calls pipapo_refill() again do check the next
entry.  Do the same in the AVX2 implementation.

Note that with this change, due to implementation differences of
pipapo_refill vs. nft_pipapo_avx2_refill, the refill call will return
the same element again. Then, on the next call, it will move to the next
entry as expected.  This is because avx2_refill doesn't clear the bitmap
in the 'last' conditional.  This is harmless. Expired/timed out elements
are also not expected to be frequent.

selftest is added in a followup commit.

Fixes: 7400b06396 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-09-24 11:50:28 +02:00
arch dibs: Move event handling to dibs layer 2025-09-23 11:13:22 +02:00
block vfs-6.17-rc6.fixes 2025-09-08 07:53:01 -07:00
certs
crypto crypto: sha512 - Implement export_core() and import_core() 2025-09-02 19:02:39 -07:00
Documentation tcp: move tcp_clean_acked to tcp_sock_read_tx group 2025-09-22 17:55:25 -07:00
drivers net: phy: stop exporting phy_driver_register 2025-09-23 16:58:42 -07:00
fs 15 hotfixes. 11 are cc:stable and the remainder address post-6.16 issues 2025-09-17 21:34:26 -07:00
include net: phy: stop exporting phy_driver_register 2025-09-23 16:58:42 -07:00
init 20 hotfixes. 15 are cc:stable and the remainder address post-6.16 issues 2025-09-10 21:19:34 -07:00
io_uring io_uring/zcrx: fix ifq->if_rxq is -1, get dma_dev is NULL 2025-09-15 18:12:53 -07:00
ipc
kernel Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-09-18 11:26:06 -07:00
lib hardening fixes for v6.17-rc4 2025-08-31 08:56:45 -07:00
LICENSES
mm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-09-18 11:26:06 -07:00
net netfilter: nft_set_pipapo_avx2: fix skip of expired entries 2025-09-24 11:50:28 +02:00
rust Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-09-18 11:26:06 -07:00
samples 15 hotfixes. 11 are cc:stable and the remainder address post-6.16 issues 2025-09-17 21:34:26 -07:00
scripts Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-09-11 17:40:13 -07:00
security
sound ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model 2025-09-01 13:51:57 +02:00
tools selftests: bridge_fdb_local_vlan_0: Test FDB vs. NET_ADDR_SET behavior 2025-09-23 17:10:49 -07:00
usr
virt
.clang-format
.clippy.toml
.cocciconfig
.editorconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap MAINTAINERS: Update Nobuhiro Iwamatsu's email address 2025-09-01 10:36:10 +02:00
.pylintrc
.rustfmt.toml
COPYING
CREDITS MAINTAINERS: retire Boris from TLS maintainers 2025-08-26 17:36:01 -07:00
Kbuild
Kconfig
MAINTAINERS dibs: Move event handling to dibs layer 2025-09-23 11:13:22 +02:00
Makefile Linux 6.17-rc6 2025-09-14 14:21:14 -07:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.