netfilter: nft_set_pipapo_avx2: fix skip of expired entries

JIRA: https://issues.redhat.com/browse/RHEL-113001
Upstream Status: commit 5823699

commit 5823699
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Sep 9 14:11:48 2025 +0200

    netfilter: nft_set_pipapo_avx2: fix skip of expired entries

    KASAN reports following splat:
    BUG: KASAN: slab-out-of-bounds in pipapo_get_avx2+0x941/0x25d0
    Read of size 1 at addr ffff88814c561be0 by task nft/3944
    Call Trace:
     pipapo_get_avx2+0x941/0x25d0
     nft_pipapo_insert+0x440/0x11b0
     nf_tables_newsetelem+0x220a/0x3a00
     ..

    This bisects to commit 84c1da7 ("netfilter: nft_set_pipapo: use AVX2
    algorithm for insertions too").

    However, that change merely uncovers this bug.

    When we find a match but that match has expired or timed out, the AVX2
    implementation restarts the full match loop.

    At that point, the pointer to the key data has already been changed and
    points to the keys last field.
    This will then result in out-of-bounds read once its incremented again
    for the next field.

    The restart logic in AVX2 is different compared to the plain C
    implementation, but both should follow the same logic.

    The C implementation just calls pipapo_refill() again do check the next
    entry.  Do the same in the AVX2 implementation.

    Note that with this change, due to implementation differences of
    pipapo_refill vs. nft_pipapo_avx2_refill, the refill call will return
    the same element again. Then, on the next call, it will move to the next
    entry as expected.  This is because avx2_refill doesn't clear the bitmap
    in the 'last' conditional.  This is harmless. Expired/timed out elements
    are also not expected to be frequent.

    selftest is added in a followup commit.

    Fixes: 7400b06 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
    Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nft_set_pipapo_avx2.c

@@ -1192,7 +1192,6 @@ nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
 
 	nft_pipapo_avx2_prepare();
 
-next_match:
 	nft_pipapo_for_each_field(f, i, m) {
 		bool last = i == m->field_count - 1, first = !i;
 		int ret = 0;
@@ -1239,14 +1238,18 @@ nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
 
 #undef NFT_SET_PIPAPO_AVX2_LOOKUP
 
+next_match:
 		if (ret < 0)
 			goto out;
 
 		if (last) {
 			const struct nft_set_ext *e = &f->mt[ret].e->ext;
 
-			if (unlikely(nft_set_elem_expired(e)))
+			if (unlikely(nft_set_elem_expired(e))) {
+				ret = pipapo_refill(res, f->bsize, f->rules,
+						    fill, f->mt, last);
 				goto next_match;
+			}
 
 			ext = e;
 			goto out;