NetBSD Problem Report #60975

From www@netbsd.org  Fri Nov  6 22:41:16 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 4F08C1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  6 Nov 2026 22:41:16 +0000 (UTC)
Message-Id: <20261106224115.1C9471A923C@mollari.NetBSD.org>
Date: Fri,  6 Nov 2026 22:41:15 +0000 (UTC)
From: joe@eloisystems.com
Reply-To: joe@eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: NPF rules are almost never BPF JIT compiled since 2014
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@eloisystems.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60975
>Category:       kern
>Synopsis:       NPF rules are almost never BPF JIT compiled since 2014
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 06 22:45:00 +0000 2026
>Last-Modified:  Sat Nov 07 17:45:01 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD 11
>Organization:
NetBSD
>Environment:
NetBSD  11.0_STABLE NetBSD 11.0_STABLE 
>Description:

wrong size is passed to npf_bpf_compile. the compile function expects a instruction size count 
but the byte count of the nvlist blob is what is sent to BPF JIT.

This almost always leads to RET instructions not falling on the last BPF code
or random crashes rules count are more than the blob size.


so setting bpf jit to 1 or on almost always sets it back to BPF interpretion or crash with some randomly odd number of rules.
>How-To-Repeat:


code inspection.
>Fix:

Yes please.

>Audit-Trail:
From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60975 CVS commit: src/usr.sbin/npf/npftest/libnpftest
Date: Sat, 7 Nov 2026 17:44:29 +0000

 Module Name:	src
 Committed By:	joe
 Date:		Sat Nov  7 17:44:29 UTC 2026

 Modified Files:
 	src/usr.sbin/npf/npftest/libnpftest: npf_bpf_test.c

 Log Message:
 PR kern/60975 add BPF validate tests to catch early if anything breaks


 To generate a diff of this commit:
 cvs rdiff -u -r1.14 -r1.15 src/usr.sbin/npf/npftest/libnpftest/npf_bpf_test.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search