d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bpf: Zero pad bytes preceding BPF headers

Browse Source 
BPF headers are word-aligned when copied into the store buffer.  Ensure
that pad bytes following the preceding packet are cleared.

Reported by:	KMSAN
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Mark Johnston 2022-06-20 12:03:37 -04:00
parent c88f6908b4
commit 60b4ad4b6b
1 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
sys/net/bpf.c
View File

@ -2536,6 +2536,7 @@ catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
void (*cpfn)(struct bpf_d *, caddr_t, u_int, void *, u_int),
struct bintime *bt)
{
static char zeroes[BPF_ALIGNMENT];
struct bpf_xhdr hdr;
#ifndef BURN_BRIDGES
struct bpf_hdr hdr_old;
@ -2543,7 +2544,7 @@ catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
struct bpf_hdr32 hdr32_old;
#endif
#endif
int caplen, curlen, hdrlen, totlen;
int caplen, curlen, hdrlen, pad, totlen;
int do_wakeup = 0;
int do_timestamp;
int tstype;
@ -2609,13 +2610,25 @@ catchpacket(struct bpf_d *d, u_char *pkt, u_int pktlen, u_int snaplen,
ROTATE_BUFFERS(d);
do_wakeup = 1;
curlen = 0;
} else if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT)
/*
* Immediate mode is set, or the read timeout has already
* expired during a select call. A packet arrived, so the
* reader should be woken up.
*/
do_wakeup = 1;
} else {
if (d->bd_immediate || d->bd_state == BPF_TIMED_OUT) {
/*
* Immediate mode is set, or the read timeout has
* already expired during a select call. A packet
* arrived, so the reader should be woken up.
*/
do_wakeup = 1;
}
pad = curlen - d->bd_slen;
KASSERT(pad >= 0 && pad <= sizeof(zeroes),
("%s: invalid pad byte count %d", __func__, pad));
if (pad > 0) {
/* Zero pad bytes. */
bpf_append_bytes(d, d->bd_sbuf, d->bd_slen, zeroes,
pad);
}
}
caplen = totlen - hdrlen;
tstype = d->bd_tstamp;
do_timestamp = tstype != BPF_T_NONE;