Commit e6107a4c74b5 for kernel

commit e6107a4c74b54cb33e3bce162a63048ae5a6b198
Author: Tamaki Yanagawa <ty@000ty.net>
Date:   Fri Jul 3 16:22:57 2026 +0000

    netfilter: nft_lookup: fix catchall element handling with inverted lookups

    nft_lookup_eval() decides whether a lookup matched (`found`) from the
    direct set lookup and priv->invert before falling back to the
    catchall element used by interval sets (e.g. nft_set_rbtree) for the
    open-ended default range. Since `found` is never recomputed after
    `ext` is replaced by the catchall lookup, inverted lookups
    (NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the
    catchall element, producing the wrong verdict. Fold the catchall
    lookup into `ext` before computing `found`, matching the order
    already used by nft_objref_map_eval().

    Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
    Signed-off-by: Tamaki Yanagawa <ty@000ty.net>
    Assisted-by: Claude:claude-sonnet-5
    Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index ba512e94b402..19887439847d 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -103,13 +103,13 @@ void nft_lookup_eval(const struct nft_expr *expr,
 	bool found;

 	ext = nft_set_do_lookup(net, set, &regs->data[priv->sreg]);
+	if (!ext)
+		ext = nft_set_catchall_lookup(net, set);
+
 	found = !!ext ^ priv->invert;
 	if (!found) {
-		ext = nft_set_catchall_lookup(net, set);
-		if (!ext) {
-			regs->verdict.code = NFT_BREAK;
-			return;
-		}
+		regs->verdict.code = NFT_BREAK;
+		return;
 	}

 	if (ext) {