NetBSD Problem Report #43185

From www@NetBSD.org  Wed Apr 21 00:29:46 2010
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 3B55B63B8FE
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 21 Apr 2010 00:29:46 +0000 (UTC)
Message-Id: <20100421002946.07DA763B8BC@www.NetBSD.org>
Date: Wed, 21 Apr 2010 00:29:46 +0000 (UTC)
From: guy@alum.mit.edu
Reply-To: guy@alum.mit.edu
To: gnats-bugs@NetBSD.org
Subject: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
X-Send-Pr-Version: www-1.0

>Number:         43185
>Category:       kern
>Synopsis:       bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Apr 21 00:30:00 +0000 2010
>Closed-Date:    Wed Apr 21 16:40:32 +0000 2010
>Last-Modified:  Tue Mar 22 20:05:01 +0000 2011
>Originator:     Guy Harris
>Release:        current
>Organization:
>Environment:
>Description:
In bpf_validate, when it checks whether the divisor in a BPF_DIV instruction is a constant 0, it does

			case BPF_DIV:
				/*
				 * Check for constant division by 0.
				 */
				if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
					return 0;
				break;

BPF_RVAL() is the macro to get the return value of a RET instruction; it extracts the 0x18 bits.  The BPF_DIV opcode is 0x30, which has the 0x10 bit set; a BPF_DIV instruction with a constant 0 as the divisor would be BPF_DIV|BPF_K, which is 0x30; BPF_RVAL(p->code) would be 0x10, which isn't equal to BPF_K, which is 0x00.

The macro to get the source argument of an arithmetic instruction is BPF_SRC(), which extracts only the 0x08 bit; BPF_SRC(p->code) would be 0x00, which is equal to BPF_K, so it should be doing

			case BPF_DIV:
				/*
				 * Check for constant division by 0.
				 */
				if (BPF_SRC(p->code) == BPF_K && p->k == 0)
					return 0;
				break;
>How-To-Repeat:
Found by inspection.
>Fix:
See full description - change BPF_RVAL to BPF_SRC in that check.

>Release-Note:

>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/43185: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
Date: Wed, 21 Apr 2010 10:41:31 +0200

 Yeah, that looks correct. Do you happen to have a test case demonstrating
 the failure?

 Martin

From: Guy Harris <guy@alum.mit.edu>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/43185: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
Date: Wed, 21 Apr 2010 02:12:12 -0700

 On Apr 21, 2010, at 1:45 AM, Martin Husemann wrote:

 > The following reply was made to PR kern/43185; it has been noted by =
 GNATS.
 >=20
 > From: Martin Husemann <martin@duskware.de>
 > To: gnats-bugs@NetBSD.org
 > Cc:=20
 > Subject: Re: kern/43185: bpf_validate() uses BPF_RVAL() when it should =
 use BPF_SRC()
 > Date: Wed, 21 Apr 2010 10:41:31 +0200
 >=20
 > Yeah, that looks correct. Do you happen to have a test case =
 demonstrating
 > the failure?

 I don't have a NetBSD VM on which to try this, and I'm not sure why I'm =
 not getting a crash on my OpenBSD 4.2 VM (OpenBSD has the same bug), but =
 a live tcpdump capture with a filter of "link[0:4]/0 =3D 2" *should* get =
 the filter rejected:

 (000) ld       [0]
 (001) div      #0
 (002) jeq      #0x2             jt 3    jf 4
 (003) ret      #65535
 (004) ret      #0

 but it doesn't (at least not on OpenBSD 4.2 - the NetBSD bpf_validate() =
 has the same code).=

From: Antti Kantee <pooka@cs.hut.fi>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/43185
Date: Wed, 21 Apr 2010 13:50:37 +0300

 I can certainly get a crash by editing sys/rump/net/rumptest to use
 your example filter:

 Index: rumptest_net.c
 ===================================================================
 RCS file: /cvsroot/src/sys/rump/net/rumptest/rumptest_net.c,v
 retrieving revision 1.19
 diff -p -u -r1.19 rumptest_net.c
 --- rumptest_net.c      29 Jan 2010 12:34:17 -0000      1.19
 +++ rumptest_net.c      21 Apr 2010 10:47:36 -0000
 @@ -261,7 +261,13 @@ static void
  dobpfread(void)
  {
         struct bpf_program bpf_prog;
 -       struct bpf_insn bpf_ins;
 +       struct bpf_insn bpf_ins[] = {
 +            { 0x20, 0, 0, 0x00000000 },
 +            { 0x34, 0, 0, 0x00000000 },
 +            { 0x15, 0, 1, 0x00000002 },
 +            { 0x6, 0, 0, 0x00000060 },
 +            { 0x6, 0, 0, 0x00000000 },
 +       };
         struct bpf_hdr *bhdr;
         void *buf;
         struct ifreq ifr;
 @@ -311,12 +317,8 @@ dobpfread(void)
         if (rump_sys_ioctl(bpfd, BIOCSETIF, &ifr) == -1)
                 err(1, "BIOCSETIF");

 -       /* accept all packets up to 9000 bytes */
 -       memset(&bpf_ins, 0, sizeof(bpf_ins));
 -       bpf_ins.code = BPF_RET + BPF_K;
 -       bpf_ins.k = 9000;
 -       bpf_prog.bf_len = 1;
 -       bpf_prog.bf_insns = &bpf_ins;
 +       bpf_prog.bf_len = __arraycount(bpf_ins);
 +       bpf_prog.bf_insns = bpf_ins;
         if (rump_sys_ioctl(bpfd, BIOCSETF, &bpf_prog) == -1)
                 err(1, "BIOCSETF");


 And then running the program:

 pain-rustique:22:/sys/rump/net/rumptest> ./rumptest_net bpf
   mbuf count:
 total mbufs: 0
 connected
 Floating exception (core dumped)
 pain-rustique:23:/sys/rump/net/rumptest> gdb rumptest_net rumptest_net.core 
 GNU gdb 6.5
 [...]
 #0  0xbbafdbad in bpf_filter (pc=0xbb82c5b8, p=0xba1ff9b4 "", wirelen=280, 
     buflen=0)
     at /usr/allsrc/src/sys/rump/dev/lib/libbpf/../../../../net/bpf_filter.c:418
 418                             A /= pc->k;
 (gdb) 

 With bpf containing the suggested patch I get the expected result.

 pain-rustique:24:/sys/rump/net/rumptest> ./rumptest_net bpf
   mbuf count:
 total mbufs: 0
 connected
 rumptest_net: BIOCSETF: Invalid argument
 pain-rustique:25:/sys/rump/net/rumptest> 

From: Guy Harris <guy@alum.mit.edu>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/43185: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
Date: Wed, 21 Apr 2010 02:40:55 -0700

 On Apr 21, 2010, at 2:12 AM, Guy Harris wrote:

 > I don't have a NetBSD VM on which to try this, and I'm not sure why =
 I'm not getting a crash on my OpenBSD 4.2 VM (OpenBSD has the same bug), =
 but a live tcpdump capture with a filter of "link[0:4]/0 =3D 2" *should* =
 get the filter rejected:

 	...

 > but it doesn't (at least not on OpenBSD 4.2 - the NetBSD =
 bpf_validate() has the same code).

 It doesn't because

 	1) I'm a moron and forgot that it actually needs to see network =
 traffic in order to try the filter

 and

 	2) the virtual machine isn't on a particularly busy network, so =
 it wasn't getting any traffic.

 If I backgrounded tcpdump and then did a ping, crashorama.=

From: Antti Kantee <pooka@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43185 CVS commit: src/tests/net
Date: Wed, 21 Apr 2010 11:07:34 +0000

 Module Name:	src
 Committed By:	pooka
 Date:		Wed Apr 21 11:07:34 UTC 2010

 Modified Files:
 	src/tests/net: Makefile
 Added Files:
 	src/tests/net/bpf: Atffile Makefile t_div-by-zero.c

 Log Message:
 Check that bpf doesn't accept programs with divide-by-zero in them.
 Example filter from Guy Harris via PR kern/43185.


 To generate a diff of this commit:
 cvs rdiff -u -r1.1 -r1.2 src/tests/net/Makefile
 cvs rdiff -u -r0 -r1.1 src/tests/net/bpf/Atffile src/tests/net/bpf/Makefile \
     src/tests/net/bpf/t_div-by-zero.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: drochner@NetBSD.org
State-Changed-When: Wed, 21 Apr 2010 16:40:32 +0000
State-Changed-Why:
fix applied, thanks. Good catch! Did you report this to the
libpcap/tcpdump maintainers?


From: Matthias Drochner <drochner@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43185 CVS commit: src/sys/net
Date: Wed, 21 Apr 2010 16:35:09 +0000

 Module Name:	src
 Committed By:	drochner
 Date:		Wed Apr 21 16:35:09 UTC 2010

 Modified Files:
 	src/sys/net: bpf_filter.c

 Log Message:
 the correct check for BPF_K is with BPF_SRC for BPF_ALU ops, from
 Guy Harris per PR kern/43185
 fixes possible division-by-zero crashes by evil filter expressions
 like "len / 0 = 1"
 pullup candidate


 To generate a diff of this commit:
 cvs rdiff -u -r1.35 -r1.36 src/sys/net/bpf_filter.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Guy Harris <guy@alum.mit.edu>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, netbsd-bugs@netbsd.org, gnats-admin@netbsd.org,
        drochner@netbsd.org
Subject: Re: kern/43185 (bpf_validate() uses BPF_RVAL() when it should use BPF_SRC())
Date: Wed, 21 Apr 2010 09:56:28 -0700

 On Apr 21, 2010, at 9:40 AM, drochner@netbsd.org wrote:

 > Synopsis: bpf_validate() uses BPF_RVAL() when it should use BPF_SRC()
 >=20
 > State-Changed-From-To: open->closed
 > State-Changed-By: drochner@NetBSD.org
 > State-Changed-When: Wed, 21 Apr 2010 16:40:32 +0000
 > State-Changed-Why:
 > fix applied, thanks. Good catch!

 I can't take credit for it - the reason I just filed several bugs =
 against various BPF implementations is that I'd filed bugs against them =
 earlier, with a patch to add OpenBSD's additional checking, and had =
 assumed the OpenBSD code was correct, so they all followed OpenBSD and =
 picked up its bug (well, FreeBSD did it differently, and didn't pick up =
 the bug).  The fixer of one of those bugs *did* notice, and I noticed =
 their change.

 > Did you report this to the
 > libpcap/tcpdump maintainers?

 Given that I'm one of the libpcap/tcpdump maintainers, I didn't have to. =
 :-)  I've checked the fix into its bpf_validate(), in both the main and =
 1.1 Git branches.=

From: Soren Jacobsen <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43185 CVS commit: [netbsd-5] src/sys/net
Date: Thu, 20 May 2010 05:13:13 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Thu May 20 05:13:13 UTC 2010

 Modified Files:
 	src/sys/net [netbsd-5]: bpf_filter.c

 Log Message:
 Pull up following revision(s) (requested by drochner in ticket #1381):
 	sys/net/bpf_filter.c: revision 1.36
 the correct check for BPF_K is with BPF_SRC for BPF_ALU ops, from
 Guy Harris per PR kern/43185
 fixes possible division-by-zero crashes by evil filter expressions
 like "len / 0 = 1"


 To generate a diff of this commit:
 cvs rdiff -u -r1.35 -r1.35.4.1 src/sys/net/bpf_filter.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Jeff Rizzo <riz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43185 CVS commit: [netbsd-4] src/sys/net
Date: Sun, 13 Jun 2010 17:51:11 +0000

 Module Name:	src
 Committed By:	riz
 Date:		Sun Jun 13 17:51:11 UTC 2010

 Modified Files:
 	src/sys/net [netbsd-4]: bpf_filter.c

 Log Message:
 Pull up following revision(s) (requested by drochner in ticket #1393):
 	sys/net/bpf_filter.c: revision 1.36
 the correct check for BPF_K is with BPF_SRC for BPF_ALU ops, from
 Guy Harris per PR kern/43185
 fixes possible division-by-zero crashes by evil filter expressions
 like "len / 0 =3D 1"
 pullup candidate


 To generate a diff of this commit:
 cvs rdiff -u -r1.32.2.1 -r1.32.2.2 src/sys/net/bpf_filter.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/43185 CVS commit: [netbsd-5-0] src/sys/net
Date: Tue, 22 Mar 2011 20:02:37 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Tue Mar 22 20:02:36 UTC 2011

 Modified Files:
 	src/sys/net [netbsd-5-0]: bpf_filter.c

 Log Message:
 Pull up following revision(s) (requested by spz in ticket #1571):
 	sys/net/bpf_filter.c: revision 1.36, 1.42 -> 1.46 via patch
 Avoid stack memory disclosure by keeping track during filter validation time
 of initialized memory. Idea taken from linux.
 Use __CTASSERT
 Use kmem instead of malloc. Requested by rmind.
 Fix userland build.
 delint.
 the correct check for BPF_K is with BPF_SRC for BPF_ALU ops, from
 Guy Harris per PR kern/43185
 fixes possible division-by-zero crashes by evil filter expressions
 like "len / 0 = 1"
 pullup candidate


 To generate a diff of this commit:
 cvs rdiff -u -r1.35 -r1.35.10.1 src/sys/net/bpf_filter.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search