From nobody@FreeBSD.org  Sat Mar 16 13:10:22 2002
Return-Path: <nobody@FreeBSD.org>
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 7A5B337B425
	for <freebsd-gnats-submit@FreeBSD.org>; Sat, 16 Mar 2002 13:10:22 -0800 (PST)
Received: (from nobody@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g2GLAMP62558;
	Sat, 16 Mar 2002 13:10:22 -0800 (PST)
	(envelope-from nobody)
Message-Id: <200203162110.g2GLAMP62558@freefall.freebsd.org>
Date: Sat, 16 Mar 2002 13:10:22 -0800 (PST)
From: Nitpicker Development Team <c.jachmann@gmx.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Wrong bpf-header preceading packet when using tunnel interface
X-Send-Pr-Version: www-1.0

>Number:         35986
>Category:       kern
>Synopsis:       Wrong bpf-header preceading packet when using tunnel interface
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 16 13:20:02 PST 2002
>Closed-Date:    Fri Aug 27 10:27:17 GMT 2004
>Last-Modified:  Fri Aug 27 10:27:17 GMT 2004
>Originator:     Nitpicker Development Team
>Release:        4.5-Stable
>Organization:
>Environment:
FreeBSD habbib 4.5-STABLE FreeBSD 4.5-STABLE #21: Tue Feb 19 21:11:17 CET 2002     jachmann@habbib:/usr/src/sys/compile/MY  i386

>Description:
When reading from bpfbuffer, after some times the process coredumps with segmentation fault
or bus error. This problem affects libpcap as well. 
gdb shows a "Bad memory address" when trying to access the next packet.

Debugging shows wrong bpfheader data:
(gdb) p bpfbuffer
$57 = 0x8112000 "\216|\223<\214\r"
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+0)
(gdb) p *hd
$58 = {bh_tstamp = {tv_sec = 1016298638, tv_usec = 888002}, bh_caplen = 44, 
  bh_datalen = 44, bh_hdrlen = 20}

(gdb) x/20 0x8112000
0x8112000:      0x3c937c8e      0x000d8cc2      0x0000002c      0x0000002c
0x8112010:      0x45470014      0x00000002      0xd4050045      0x0040399d

ippacketsize(0x8112019) tells us, packetsize would be d405 (swapped 05d4=1492)

Trusting the bpfheader, next packet is:
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+64)
(gdb) p *hd
$60 = {bh_tstamp = {tv_sec = 1763515806, tv_usec = 805317992}, 
  bh_caplen = 3563283504, bh_datalen = 1258291218, bh_hdrlen = 16069}

Trusting the ippacket, next data would be:
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+1516)
(gdb) p *hd
$62 = {bh_tstamp = {tv_sec = 1016298638, tv_usec = 891856}, bh_caplen = 109, 
  bh_datalen = 109, bh_hdrlen = 20}

1516 because size(1492)+Tunnelheader(4)+bpfheader(20)

>How-To-Repeat:
Read quiete a while (several hours) from a tunnel interface and watch it coredump

>Fix:
      None known
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: arved 
State-Changed-When: Thu Aug 26 14:21:55 GMT 2004 
State-Changed-Why:  
Does it still occur with recent versions of FreeBSD? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=35986 
State-Changed-From-To: feedback->closed 
State-Changed-By: arved 
State-Changed-When: Fri Aug 27 10:25:49 GMT 2004 
State-Changed-Why:  
Submitters email bounces: 

Hi. This is the qmail-send program at thematrix.nitpicker.de. 
I'm afraid I wasn't able to deliver your message to the following addresses. 
This is a permanent error; I've given up. Sorry it didn't work out. 

<nitpicker@nitpicker.de>: 
ezmlm-reject: fatal: List address must be in To: or Cc: (#5.7.0) 

http://www.freebsd.org/cgi/query-pr.cgi?pr=35986 
>Unformatted:
