netfilter: nf_tables: missing iterator type in lookup walk

jira LE-2169
cve CVE-2024-27017
Rebuild_History Non-Buildable kernel-4.18.0-553.27.1.el8_10
commit-author Pablo Neira Ayuso <[email protected]>
commit efefd4f
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.27.1.el8_10/efefd4f0.failed

Add missing decorator type to lookup expression and tighten WARN_ON_ONCE
check in pipapo to spot earlier that this is unset.

Fixes: 29b359c ("netfilter: nft_set_pipapo: walk over current view on netlink dump")
	Signed-off-by: Pablo Neira Ayuso <[email protected]>
(cherry picked from commit efefd4f)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	net/netfilter/nft_set_pipapo.c

Author: PlaidCat

ciq/ciq_backports/kernel-4.18.0-553.27.1.el8_10/efefd4f0.failed

@@ -0,0 +1,62 @@
+netfilter: nf_tables: missing iterator type in lookup walk
+
+jira LE-2169
+cve CVE-2024-27017
+Rebuild_History Non-Buildable kernel-4.18.0-553.27.1.el8_10
+commit-author Pablo Neira Ayuso <[email protected]>
+commit efefd4f00c967d00ad7abe092554ffbb70c1a793
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.27.1.el8_10/efefd4f0.failed
+
+Add missing decorator type to lookup expression and tighten WARN_ON_ONCE
+check in pipapo to spot earlier that this is unset.
+
+Fixes: 29b359cf6d95 ("netfilter: nft_set_pipapo: walk over current view on netlink dump")
+	Signed-off-by: Pablo Neira Ayuso <[email protected]>
+(cherry picked from commit efefd4f00c967d00ad7abe092554ffbb70c1a793)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	net/netfilter/nft_set_pipapo.c
+diff --cc net/netfilter/nft_set_pipapo.c
+index 4b6a6667d72b,0f903d18bbea..000000000000
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@@ -1908,13 -2119,15 +1908,22 @@@ static void nft_pipapo_walk(const struc
+  			    struct nft_set_iter *iter)
+  {
+  	struct nft_pipapo *priv = nft_set_priv(set);
+++<<<<<<< HEAD
+ +	struct net *net = read_pnet(&set->net);
+ +	struct nft_pipapo_match *m;
+ +	struct nft_pipapo_field *f;
+ +	int i, r;
+++=======
++ 	const struct nft_pipapo_match *m;
++ 	const struct nft_pipapo_field *f;
++ 	unsigned int i, r;
++ 
++ 	WARN_ON_ONCE(iter->type != NFT_ITER_READ &&
++ 		     iter->type != NFT_ITER_UPDATE);
+++>>>>>>> efefd4f00c96 (netfilter: nf_tables: missing iterator type in lookup walk)
+  
+  	rcu_read_lock();
+ -	if (iter->type == NFT_ITER_READ)
+ +	if (iter->genmask == nft_genmask_cur(net))
+  		m = rcu_dereference(priv->match);
+  	else
+  		m = priv->clone;
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index 828f87bb9145..87e14d317ae3 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -209,6 +209,7 @@ static int nft_lookup_validate(const struct nft_ctx *ctx,
+ 		return 0;
+ 
+ 	iter.genmask	= nft_genmask_next(ctx->net);
++	iter.type	= NFT_ITER_UPDATE;
+ 	iter.skip	= 0;
+ 	iter.count	= 0;
+ 	iter.err	= 0;
+* Unmerged path net/netfilter/nft_set_pipapo.c