Florian Westphal b5ad58285f netfilter: nf_set_pipapo_avx2: fix initial map fill ...

[ Upstream commit ea77c397bf ]

If the first field doesn't cover the entire start map, then we must zero
out the remainder, else we leak those bits into the next match round map.

The early fix was incomplete and did only fix up the generic C
implementation.

A followup patch adds a test case to nft_concat_range.sh.

Fixes: 791a615b7a ("netfilter: nf_set_pipapo: fix initial map fill")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-06-27 11:05:18 +01:00

..

ipset

netfilter: ipset: fix region locking in hash types

2025-05-18 08:20:35 +02:00

ipvs

ipvs: properly dereference pe in ip_vs_add_service

2025-05-02 07:44:22 +02:00

core.c

netfilter: let reset rules clean out conntrack entries

2024-03-06 14:38:46 +00:00

Kconfig

netfilter: nf_flow_table: count pending offload workqueue tasks

2024-04-27 17:05:24 +02:00

Makefile

netfilter: nf_flow_table: count pending offload workqueue tasks

2024-04-27 17:05:24 +02:00

nf_conncount.c

netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()

2025-04-10 14:31:49 +02:00

nf_conntrack_acct.c

…

nf_conntrack_amanda.c

…

nf_conntrack_broadcast.c

…

nf_conntrack_core.c

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

2025-01-23 17:15:50 +01:00

nf_conntrack_ecache.c

…

nf_conntrack_expect.c

…

nf_conntrack_extend.c

…

nf_conntrack_ftp.c

…

nf_conntrack_h323_asn1.c

netfilter: nf_conntrack_h323: Add protection for bmp length out of range

2024-03-15 10:48:15 -04:00

nf_conntrack_h323_main.c

…

nf_conntrack_h323_types.c

…

nf_conntrack_helper.c

netfilter: conntrack: Avoid nf_ct_helper_hash uses after free

2023-07-23 13:47:37 +02:00

nf_conntrack_irc.c

…

nf_conntrack_labels.c

…

nf_conntrack_netbios_ns.c

…

nf_conntrack_netlink.c

netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS

2024-10-17 15:11:09 +02:00

nf_conntrack_pptp.c

…

nf_conntrack_proto_dccp.c

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one

2023-07-23 13:46:56 +02:00

nf_conntrack_proto_generic.c

…

nf_conntrack_proto_gre.c

…

nf_conntrack_proto_icmp.c

…

nf_conntrack_proto_icmpv6.c

…

nf_conntrack_proto_sctp.c

netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new

2024-03-01 13:21:45 +01:00

nf_conntrack_proto_tcp.c

netfilter: let reset rules clean out conntrack entries

2024-03-06 14:38:46 +00:00

nf_conntrack_proto_udp.c

…

nf_conntrack_proto.c

…

nf_conntrack_sane.c

…

nf_conntrack_seqadj.c

…

nf_conntrack_sip.c

netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.

2023-07-23 13:46:56 +02:00

nf_conntrack_snmp.c

…

nf_conntrack_standalone.c

netfilter: conntrack: Bound nf_conntrack sysctl writes

2025-06-04 14:37:57 +02:00

nf_conntrack_tftp.c

…

nf_conntrack_timeout.c

…

nf_conntrack_timestamp.c

…

nf_dup_netdev.c

…

nf_flow_table_core.c

netfilter: nf_flow_table: count pending offload workqueue tasks

2024-04-27 17:05:24 +02:00

nf_flow_table_inet.c

netfilter: flowtable: validate vlan header

2024-09-04 13:23:34 +02:00

nf_flow_table_ip.c

netfilter: flowtable: validate vlan header

2024-09-04 13:23:34 +02:00

nf_flow_table_offload.c

netfilter: flowtable: initialise extack before use

2024-09-04 13:23:19 +02:00

nf_flow_table_procfs.c

netfilter: nf_flow_table: count pending offload workqueue tasks

2024-04-27 17:05:24 +02:00

nf_hooks_lwtunnel.c

…

nf_internals.h

…

nf_log_syslog.c

…

nf_log.c

netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger

2024-02-23 08:54:54 +01:00

nf_nat_amanda.c

…

nf_nat_core.c

netfilter: make function op structures const

2024-03-06 14:38:46 +00:00

nf_nat_ftp.c

…

nf_nat_helper.c

…

nf_nat_irc.c

…

nf_nat_masquerade.c

…

nf_nat_proto.c

…

nf_nat_redirect.c

netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses

2023-11-20 11:08:29 +01:00

nf_nat_sip.c

…

nf_nat_tftp.c

…

nf_queue.c

…

nf_sockopt.c

…

nf_synproxy_core.c

…

nf_tables_api.c

netfilter: nf_tables: do not defer rule destruction via call_rcu

2025-05-22 14:08:28 +02:00

nf_tables_core.c

…

nf_tables_offload.c

…

nf_tables_trace.c

…

nfnetlink_acct.c

…

nfnetlink_cthelper.c

…

nfnetlink_cttimeout.c

…

nfnetlink_hook.c

Remove DECnet support from kernel

2023-06-21 15:59:15 +02:00

nfnetlink_log.c

netfilter: nfnetlink_log: silence bogus compiler warning

2023-11-08 17:26:47 +01:00

nfnetlink_osf.c

netfilter: nfnetlink_osf: avoid OOB read

2023-09-19 12:23:00 +02:00

nfnetlink_queue.c

netfilter: nf_queue: drop packets with cloned unconfirmed conntracks

2024-09-04 13:23:19 +02:00

nfnetlink.c

netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM

2023-06-21 15:59:16 +02:00

nft_bitwise.c

…

nft_byteorder.c

netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()

2023-11-28 16:56:24 +00:00

nft_chain_filter.c

netfilter: nf_tables: honor table dormant flag from netdev release event path

2024-05-02 16:24:46 +02:00

nft_chain_nat.c

…

nft_chain_route.c

…

nft_cmp.c

…

nft_compat.c

netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()

2024-03-06 14:38:46 +00:00

nft_connlimit.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-08-19 05:45:50 +02:00

nft_counter.c

netfilter: nft_counter: Synchronize nft_counter_reset() against reader.

2024-09-04 13:23:32 +02:00

nft_ct.c

netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.

2025-04-10 14:31:48 +02:00

nft_dup_netdev.c

…

nft_dynset.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-08-19 05:45:50 +02:00

nft_exthdr.c

netfilter: nft_exthdr: fix offset with ipv4_find_option()

2025-04-10 14:31:49 +02:00

nft_fib_inet.c

…

nft_fib_netdev.c

…

nft_fib.c

netfilter: nf_tables: fix 'exist' matching on bigendian arches

2023-12-20 15:17:33 +01:00

nft_flow_offload.c

netfilter: nft_flow_offload: update tcp state flags under lock

2025-03-13 12:49:59 +01:00

nft_fwd_netdev.c

…

nft_hash.c

…

nft_immediate.c

netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx

2025-05-22 14:08:27 +02:00

nft_last.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-08-19 05:45:50 +02:00

nft_limit.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-08-19 05:45:50 +02:00

nft_log.c

…

nft_lookup.c

netfilter: nf_tables: missing iterator type in lookup walk

2024-10-17 15:10:41 +02:00

nft_masq.c

netfilter: nft_masq: correct length for loading protocol registers

2023-03-22 13:31:23 +01:00

nft_meta.c

netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()

2023-11-28 16:56:24 +00:00

nft_nat.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:54:29 +01:00

nft_numgen.c

…

nft_objref.c

netfilter: nf_tables: report use refcount overflow

2023-08-16 18:22:03 +02:00

nft_osf.c

netfilter: nf_tables: use the correct get/put helpers

2023-11-28 16:56:24 +00:00

nft_payload.c

netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

2024-11-08 16:25:53 +01:00

nft_queue.c

…

nft_quota.c

netfilter: nft_quota: match correctly when the quota just depleted

2025-06-27 11:05:12 +01:00

nft_range.c

…

nft_redir.c

netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs

2023-11-20 11:08:29 +01:00

nft_reject_inet.c

…

nft_reject_netdev.c

…

nft_reject.c

…

nft_rt.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:54:29 +01:00

nft_set_bitmap.c

netfilter: nf_tables: drop map element references from preparation phase

2023-07-23 13:46:44 +02:00

nft_set_hash.c

netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only

2025-04-10 14:32:04 +02:00

nft_set_pipapo_avx2.c

netfilter: nf_set_pipapo_avx2: fix initial map fill

2025-06-27 11:05:18 +01:00

nft_set_pipapo_avx2.h

…

nft_set_pipapo.c

netfilter: nf_tables: missing iterator type in lookup walk

2024-10-17 15:10:41 +02:00

nft_set_pipapo.h

netfilter: nf_set_pipapo: fix initial map fill

2024-08-19 05:45:07 +02:00

nft_set_rbtree.c

netfilter: nf_tables: use timestamp to check for set element timeout

2024-08-19 05:45:50 +02:00

nft_socket.c

netfilter: nft_socket: fix sk refcount leaks

2024-10-17 15:10:37 +02:00

nft_synproxy.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:54:29 +01:00

nft_tproxy.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:54:29 +01:00

nft_tunnel.c

netfilter: nft_tunnel: fix geneve_opt dump

2025-06-27 11:05:13 +01:00

nft_xfrm.c

netfilter: nf_tables: validate NFPROTO_* family

2024-02-23 08:54:29 +01:00

utils.c

…

x_tables.c

netfilter: Fix use-after-free in get_info()

2024-11-08 16:25:53 +01:00

xt_addrtype.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_AUDIT.c

…

xt_bpf.c

…

xt_cgroup.c

…

xt_CHECKSUM.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_CLASSIFY.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_cluster.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_comment.c

…

xt_connbytes.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_connlabel.c

…

xt_connlimit.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_connmark.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_CONNSECMARK.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_conntrack.c

…

xt_cpu.c

…

xt_CT.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_dccp.c

…

xt_devgroup.c

…

xt_dscp.c

…

xt_DSCP.c

…

xt_ecn.c

…

xt_esp.c

…

xt_hashlimit.c

…

xt_helper.c

…

xt_hl.c

…

xt_HL.c

…

xt_HMARK.c

…

xt_IDLETIMER.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_ipcomp.c

…

xt_iprange.c

…

xt_ipvs.c

…

xt_l2tp.c

…

xt_LED.c

netfilter: x_tables: fix LED ID check in led_tg_check()

2024-12-14 19:51:26 +01:00

xt_length.c

…

xt_limit.c

…

xt_LOG.c

…

xt_mac.c

…

xt_mark.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-11-01 01:52:36 +01:00

xt_MASQUERADE.c

…

xt_multiport.c

…

xt_nat.c

…

xt_NETMAP.c

…

xt_nfacct.c

…

xt_NFLOG.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-11-01 01:52:36 +01:00

xt_NFQUEUE.c

…

xt_osf.c

netfilter: nfnetlink_osf: fix module autoload

2023-06-28 10:29:49 +02:00

xt_owner.c

netfilter: xt_owner: Fix for unsafe access of sk->sk_socket

2023-12-13 18:36:37 +01:00

xt_physdev.c

…

xt_pkttype.c

…

xt_policy.c

…

xt_quota.c

…

xt_rateest.c

…

xt_RATEEST.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_realm.c

…

xt_recent.c

netfilter: xt_recent: fix (increase) ipv6 literal buffer length

2023-11-20 11:08:29 +01:00

xt_REDIRECT.c

netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs

2023-11-20 11:08:29 +01:00

xt_repldata.h

…

xt_sctp.c

netfilter: xt_sctp: validate the flag_info count

2023-09-19 12:22:49 +02:00

xt_SECMARK.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-17 15:11:56 +02:00

xt_set.c

…

xt_socket.c

…

xt_state.c

…

xt_statistic.c

…

xt_string.c

…

xt_tcpmss.c

…

xt_TCPMSS.c

…

xt_TCPOPTSTRIP.c

…

xt_tcpudp.c

…

xt_TEE.c

…

xt_time.c

…

xt_TPROXY.c

…

xt_TRACE.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-11-01 01:52:36 +01:00

xt_u32.c

netfilter: xt_u32: validate user space input

2023-09-19 12:22:49 +02:00