From nobody@FreeBSD.org  Wed Nov 30 08:49:49 2005
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id EB9B316A41F
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 08:49:49 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9A8C143D45
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 08:49:49 +0000 (GMT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id jAU8nnpr048825
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 30 Nov 2005 08:49:49 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id jAU8nnAo048824;
	Wed, 30 Nov 2005 08:49:49 GMT
	(envelope-from nobody)
Message-Id: <200511300849.jAU8nnAo048824@www.freebsd.org>
Date: Wed, 30 Nov 2005 08:49:49 GMT
From: Guy Harris <guy@alum.mit.edu>
To: freebsd-gnats-submit@FreeBSD.org
Subject: BPF indexed byte load can sign extend
X-Send-Pr-Version: www-2.3

>Number:         89748
>Category:       kern
>Synopsis:       [bpf] [patch] BPF indexed byte load can sign extend
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    dwmalone
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Nov 30 08:50:02 GMT 2005
>Closed-Date:    Mon Aug 21 12:46:53 GMT 2006
>Last-Modified:  Mon Aug 21 12:46:53 GMT 2006
>Originator:     Guy Harris
>Release:        
>Organization:
>Environment:
>Description:
The code to handle BPF non-indexed loads in bpf_filter() in bpf_filter.c is:

        case BPF_LD|BPF_B|BPF_ABS:
            k = pc->k;
            if (k >= buflen) {
#ifdef _KERNEL
                struct mbuf *m;
                int len;

                if (buflen != 0)
                    return 0;
                m = (struct mbuf *)p;
                MINDEX(len, m, k);
                A = mtod(m, u_char *)[k];
                continue;
#else
                return 0;
#endif
            }
            A = p[k];
            continue;

which will load the byte at the offset in the instruction into the accumulator, zero-extending it.

The code to handle indexed loads is

        case BPF_LD|BPF_B|BPF_IND:
            k = X + pc->k;
            if (k >= buflen) {
#ifdef _KERNEL
                struct mbuf *m;
                int len;

                if (buflen != 0)
                    return 0;
                m = (struct mbuf *)p;
                MINDEX(len, m, k);
                A = mtod(m, char *)[k];
                continue;
#else
                return 0;
#endif
            }
            A = p[k];
            continue;

which will load the byte at the offset that's the sum of the offset in the instruction and the contents of the index register; if buflen is 0, as is the case when this is called from bpf_mtap(), it will sign-extend it on most if not all platforms, as the mbuf data pointer is cast to "char *" rather than "u_char *".  Otherwise, as is the case when this is called from bpf_tap(), it'll zero-extend it, as "p" is a "u_char *".

Presumably those semantics are not intended, as the same instruction behaves differently depending on how the tapping is being done, and on whether the load is indexed or not.  (In libpcap's user-mode filter, it's never sign-extended.)

In NetBSD, it's "u_char" in both "mtod()" calls, fixing that.

>How-To-Repeat:
              
>Fix:
Index: bpf_filter.c
===================================================================
RCS file: /cvs/src/sys/net/bpf_filter.c,v
retrieving revision 1.15
diff -c -r1.15 bpf_filter.c
*** bpf_filter.c	28 Sep 2005 20:53:56 -0000	1.15
--- bpf_filter.c	30 Nov 2005 07:58:29 -0000
***************
*** 301,307 ****
  					return 0;
  				m = (struct mbuf *)p;
  				MINDEX(len, m, k);
! 				A = mtod(m, char *)[k];
  				continue;
  #else
  				return 0;
--- 301,307 ----
  					return 0;
  				m = (struct mbuf *)p;
  				MINDEX(len, m, k);
! 				A = mtod(m, u_char *)[k];
  				continue;
  #else
  				return 0;

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->dwmalone 
Responsible-Changed-By: dwmalone 
Responsible-Changed-When: Sun May 28 20:03:59 UTC 2006 
Responsible-Changed-Why:  
I've committed the patch to -current and will merge it in a couple of weeks. 

David. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89748 
State-Changed-From-To: open->closed 
State-Changed-By: dwmalone 
State-Changed-When: Mon Aug 21 12:46:06 UTC 2006 
State-Changed-Why:  
I've merged the patch to RELENG_[456] from -current. Thanks 
for the patch, 

David. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=89748 
>Unformatted:
