Skip to content

Commit 785fbe6

Browse files
pvts-matPlaidCat
pvts-mat
authored and
PlaidCat
committed
netfilter: nft_set_pipapo: constify lookup fn args where possible
jira VULN-42212 cve-pre CVE-2024-57947 commit-author Florian Westphal <fw@strlen.de> commit f04df57 upstream-diff Context conflicts resolution in `nft_pipapo_avx2_lookup()'. No actual diff. Those get called from packet path, content must not be modified. No functional changes intended. Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit f04df57) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
1 parent a201f2c commit 785fbe6

3 files changed

Lines changed: 48 additions & 35 deletions

File tree

‎net/netfilter/nft_set_pipapo.c‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ static DEFINE_PER_CPU(bool, nft_pipapo_scratch_index);
363363
* Return: -1 on no match, bit position on 'match_only', 0 otherwise.
364364
*/
365365
int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
366-
union nft_pipapo_map_bucket *mt, bool match_only)
366+
const union nft_pipapo_map_bucket *mt, bool match_only)
367367
{
368368
unsigned long bitset;
369369
int k, ret = -1;
@@ -414,9 +414,9 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
414414
struct nft_pipapo *priv = nft_set_priv(set);
415415
unsigned long *res_map, *fill_map;
416416
u8 genmask = nft_genmask_cur(net);
417+
const struct nft_pipapo_match *m;
418+
const struct nft_pipapo_field *f;
417419
const u8 *rp = (const u8 *)key;
418-
struct nft_pipapo_match *m;
419-
struct nft_pipapo_field *f;
420420
bool map_index;
421421
int i;
422422

@@ -519,11 +519,13 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net,
519519
{
520520
struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT);
521521
struct nft_pipapo *priv = nft_set_priv(set);
522-
struct nft_pipapo_match *m = priv->clone;
523522
unsigned long *res_map, *fill_map = NULL;
524-
struct nft_pipapo_field *f;
523+
const struct nft_pipapo_match *m;
524+
const struct nft_pipapo_field *f;
525525
int i;
526526

527+
m = priv->clone;
528+
527529
res_map = kmalloc_array(m->bsize_max, sizeof(*res_map), GFP_ATOMIC);
528530
if (!res_map) {
529531
ret = ERR_PTR(-ENOMEM);
@@ -1580,7 +1582,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m)
15801582

15811583
while ((rules_f0 = pipapo_rules_same_key(m->f, first_rule))) {
15821584
union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS];
1583-
struct nft_pipapo_field *f;
1585+
const struct nft_pipapo_field *f;
15841586
int i, start, rules_fx;
15851587

15861588
start = first_rule;
@@ -2025,8 +2027,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
20252027
struct nft_set_iter *iter)
20262028
{
20272029
struct nft_pipapo *priv = nft_set_priv(set);
2028-
struct nft_pipapo_match *m;
2029-
struct nft_pipapo_field *f;
2030+
const struct nft_pipapo_match *m;
2031+
const struct nft_pipapo_field *f;
20302032
int i, r;
20312033

20322034
WARN_ON_ONCE(iter->type != NFT_ITER_READ &&

‎net/netfilter/nft_set_pipapo.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -179,15 +179,15 @@ struct nft_pipapo_elem {
179179
};
180180

181181
int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
182-
union nft_pipapo_map_bucket *mt, bool match_only);
182+
const union nft_pipapo_map_bucket *mt, bool match_only);
183183

184184
/**
185185
* pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
186186
* @f: Field including lookup table
187187
* @dst: Area to store result
188188
* @data: Input data selecting table buckets
189189
*/
190-
static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f,
190+
static inline void pipapo_and_field_buckets_4bit(const struct nft_pipapo_field *f,
191191
unsigned long *dst,
192192
const u8 *data)
193193
{
@@ -215,7 +215,7 @@ static inline void pipapo_and_field_buckets_4bit(struct nft_pipapo_field *f,
215215
* @dst: Area to store result
216216
* @data: Input data selecting table buckets
217217
*/
218-
static inline void pipapo_and_field_buckets_8bit(struct nft_pipapo_field *f,
218+
static inline void pipapo_and_field_buckets_8bit(const struct nft_pipapo_field *f,
219219
unsigned long *dst,
220220
const u8 *data)
221221
{

‎net/netfilter/nft_set_pipapo_avx2.c‎

Lines changed: 35 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -215,8 +215,9 @@ static int nft_pipapo_avx2_refill(int offset, unsigned long *map,
215215
* word index to be checked next (i.e. first filled word).
216216
*/
217217
static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill,
218-
struct nft_pipapo_field *f, int offset,
219-
const u8 *pkt, bool first, bool last)
218+
const struct nft_pipapo_field *f,
219+
int offset, const u8 *pkt,
220+
bool first, bool last)
220221
{
221222
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
222223
u8 pg[2] = { pkt[0] >> 4, pkt[0] & 0xf };
@@ -277,8 +278,9 @@ static int nft_pipapo_avx2_lookup_4b_2(unsigned long *map, unsigned long *fill,
277278
* word index to be checked next (i.e. first filled word).
278279
*/
279280
static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill,
280-
struct nft_pipapo_field *f, int offset,
281-
const u8 *pkt, bool first, bool last)
281+
const struct nft_pipapo_field *f,
282+
int offset, const u8 *pkt,
283+
bool first, bool last)
282284
{
283285
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
284286
u8 pg[4] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf };
@@ -353,8 +355,9 @@ static int nft_pipapo_avx2_lookup_4b_4(unsigned long *map, unsigned long *fill,
353355
* word index to be checked next (i.e. first filled word).
354356
*/
355357
static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill,
356-
struct nft_pipapo_field *f, int offset,
357-
const u8 *pkt, bool first, bool last)
358+
const struct nft_pipapo_field *f,
359+
int offset, const u8 *pkt,
360+
bool first, bool last)
358361
{
359362
u8 pg[8] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf,
360363
pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf,
@@ -448,8 +451,9 @@ static int nft_pipapo_avx2_lookup_4b_8(unsigned long *map, unsigned long *fill,
448451
* word index to be checked next (i.e. first filled word).
449452
*/
450453
static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill,
451-
struct nft_pipapo_field *f, int offset,
452-
const u8 *pkt, bool first, bool last)
454+
const struct nft_pipapo_field *f,
455+
int offset, const u8 *pkt,
456+
bool first, bool last)
453457
{
454458
u8 pg[12] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf,
455459
pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf,
@@ -537,8 +541,9 @@ static int nft_pipapo_avx2_lookup_4b_12(unsigned long *map, unsigned long *fill,
537541
* word index to be checked next (i.e. first filled word).
538542
*/
539543
static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill,
540-
struct nft_pipapo_field *f, int offset,
541-
const u8 *pkt, bool first, bool last)
544+
const struct nft_pipapo_field *f,
545+
int offset, const u8 *pkt,
546+
bool first, bool last)
542547
{
543548
u8 pg[32] = { pkt[0] >> 4, pkt[0] & 0xf, pkt[1] >> 4, pkt[1] & 0xf,
544549
pkt[2] >> 4, pkt[2] & 0xf, pkt[3] >> 4, pkt[3] & 0xf,
@@ -672,8 +677,9 @@ static int nft_pipapo_avx2_lookup_4b_32(unsigned long *map, unsigned long *fill,
672677
* word index to be checked next (i.e. first filled word).
673678
*/
674679
static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill,
675-
struct nft_pipapo_field *f, int offset,
676-
const u8 *pkt, bool first, bool last)
680+
const struct nft_pipapo_field *f,
681+
int offset, const u8 *pkt,
682+
bool first, bool last)
677683
{
678684
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
679685
unsigned long *lt = f->lt, bsize = f->bsize;
@@ -729,8 +735,9 @@ static int nft_pipapo_avx2_lookup_8b_1(unsigned long *map, unsigned long *fill,
729735
* word index to be checked next (i.e. first filled word).
730736
*/
731737
static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill,
732-
struct nft_pipapo_field *f, int offset,
733-
const u8 *pkt, bool first, bool last)
738+
const struct nft_pipapo_field *f,
739+
int offset, const u8 *pkt,
740+
bool first, bool last)
734741
{
735742
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
736743
unsigned long *lt = f->lt, bsize = f->bsize;
@@ -793,8 +800,9 @@ static int nft_pipapo_avx2_lookup_8b_2(unsigned long *map, unsigned long *fill,
793800
* word index to be checked next (i.e. first filled word).
794801
*/
795802
static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill,
796-
struct nft_pipapo_field *f, int offset,
797-
const u8 *pkt, bool first, bool last)
803+
const struct nft_pipapo_field *f,
804+
int offset, const u8 *pkt,
805+
bool first, bool last)
798806
{
799807
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
800808
unsigned long *lt = f->lt, bsize = f->bsize;
@@ -868,8 +876,9 @@ static int nft_pipapo_avx2_lookup_8b_4(unsigned long *map, unsigned long *fill,
868876
* word index to be checked next (i.e. first filled word).
869877
*/
870878
static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill,
871-
struct nft_pipapo_field *f, int offset,
872-
const u8 *pkt, bool first, bool last)
879+
const struct nft_pipapo_field *f,
880+
int offset, const u8 *pkt,
881+
bool first, bool last)
873882
{
874883
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
875884
unsigned long *lt = f->lt, bsize = f->bsize;
@@ -953,8 +962,9 @@ static int nft_pipapo_avx2_lookup_8b_6(unsigned long *map, unsigned long *fill,
953962
* word index to be checked next (i.e. first filled word).
954963
*/
955964
static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill,
956-
struct nft_pipapo_field *f, int offset,
957-
const u8 *pkt, bool first, bool last)
965+
const struct nft_pipapo_field *f,
966+
int offset, const u8 *pkt,
967+
bool first, bool last)
958968
{
959969
int i, ret = -1, m256_size = f->bsize / NFT_PIPAPO_LONGS_PER_M256, b;
960970
unsigned long *lt = f->lt, bsize = f->bsize;
@@ -1045,8 +1055,9 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill,
10451055
* word index to be checked next (i.e. first filled word).
10461056
*/
10471057
static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,
1048-
struct nft_pipapo_field *f, int offset,
1049-
const u8 *pkt, bool first, bool last)
1058+
const struct nft_pipapo_field *f,
1059+
int offset, const u8 *pkt,
1060+
bool first, bool last)
10501061
{
10511062
unsigned long *lt = f->lt, bsize = f->bsize;
10521063
int i, ret = -1, b;
@@ -1124,9 +1135,9 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
11241135
struct nft_pipapo *priv = nft_set_priv(set);
11251136
unsigned long *res, *fill, *scratch;
11261137
u8 genmask = nft_genmask_cur(net);
1138+
const struct nft_pipapo_match *m;
1139+
const struct nft_pipapo_field *f;
11271140
const u8 *rp = (const u8 *)key;
1128-
struct nft_pipapo_match *m;
1129-
struct nft_pipapo_field *f;
11301141
bool map_index;
11311142
int i, ret = 0;
11321143

0 commit comments

Comments
 (0)