From nobody Sun Dec 14 15:49:44 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dTngr5ZYLz6KNxv for ; Sun, 14 Dec 2025 15:49:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dTngr2Ftdz42H8 for ; Sun, 14 Dec 2025 15:49:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765727384; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OZ2ugbJF4QYj8Mj1XlvyKnXWVRgjpXgOQdSUtUN3XxY=; b=C4iwMlRM95HaOuyhb8QJuvEuzXazvCnPTC2D31j/aOPS03VDvEhDVjVTJlqwRMArog5Ad/ JCSdN6Fh5xEGH1CzyG5ZeLtWAIu6xQr+O1RIGDo+KL2lgVOO7rgH7jDuCyHLwHGv2oj8Cs ribASjplpEurPb29bXEivamdKyF6uAsO5KlSMql4fQ9gJTRlCksQfD7wCc6+efrl1z4rHY BfRh5RYtwaR2rJOBVlxFOfuIckO+ytdRYk1PF+CFw6o0Vw0Y5cZNTaJ0WD/jkLBGr+Tlds DBySnS8zCaEKGPQhFQZvIgcs2FUT/VI+PhnwIHrHXmZOufx12oWBKFLj+QXXUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1765727384; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OZ2ugbJF4QYj8Mj1XlvyKnXWVRgjpXgOQdSUtUN3XxY=; b=FbxQPMj3GXtAy/Vs51WmSeJePjbyiJ3hdbvxrAHCqvUUxpSAhgKdWSjgE7VUkP5cgdGnT7 uG0mDhQcW8WW3S+I4KmwccNk6B7ajeJa8ST+6LAyc+/JswfzX7IJ7qtv+OHDTKbrVFuvPB tndU3QYPtNx9PLdwG3WOkZ7SI/WAuYv83f3zmPxQquwpxngcBFYhEr9hwCZ+nF2v4sOKR8 /G9UavUDJhT8dh+yByCUw5NImIjrs4MnuR9IvCCwV4EXO5/YZWdA6TLVJBtfZU+TDpdSYe /lrD527R1RhaX2ohhUi2n0EwmcUoyK0XLpol+liQAuH5lkPlWVGm2/HCOaS1GA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1765727384; a=rsa-sha256; cv=none; b=FK+2Dl8QfBM6VpxZbc1/lypzJlq0nql/4HHkS7fmxxEgCRw2NPfMF26ieUgkidUJwAccGr mC3TJwKGouGY44r6paAfa/s3fr+WMBjJCUaW5ZWpJeaO7p8aUKI3bgMm1r7wXW48n3Jq9b j9OJtu72YZ8mXk2tMmXOQiMWgJPNf5g+ApCv9LU+ynUa4hL00V4BMQV89VRxy47rXZ3UZ9 v1EHUxnVryRIIUSi7BkkFTjnT7mfwikdYShowRbPTWYXJOn9tpK9nM8UdQ7GXGxxmtoGK+ H7ZhEZ0hIvaglqJvqeLzqYWwsiNy3VlYsmYxGLvk35bcWQepHbBEaJftiPy+Jw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dTngr1sWvzg1d for ; Sun, 14 Dec 2025 15:49:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33cb7 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 14 Dec 2025 15:49:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 796abca7e281 - main - pfsync: Avoid zeroing the state export union List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 796abca7e281f0d4b7f72f48da4f941e1c8b139c Auto-Submitted: auto-generated Date: Sun, 14 Dec 2025 15:49:44 +0000 Message-Id: <693edc98.33cb7.439a1cad@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=796abca7e281f0d4b7f72f48da4f941e1c8b139c commit 796abca7e281f0d4b7f72f48da4f941e1c8b139c Author: Mark Johnston AuthorDate: 2025-12-14 15:48:27 +0000 Commit: Mark Johnston CommitDate: 2025-12-14 15:48:27 +0000 pfsync: Avoid zeroing the state export union pfsync_state_export() takes a pointer to a union that is in reality a pointer to one of the three state formats (1301, 1400, 1500), and zeros the union. The three formats do not have the same size, so zeroing is wrong when the format isn't that which has the largest size. Refactor a bit so that the zeroing happens at the layer where we know which format we're dealing with. Reported by: CHERI Reviewed by: kp MFC after: 1 week Sponsored by: CHERI Research Centre (EPSRC grant UKRI3001) Differential Revision: https://reviews.freebsd.org/D54163 --- sys/net/pfvar.h | 8 ++++++-- sys/netpfil/pf/if_pfsync.c | 15 +++++++++------ sys/netpfil/pf/pf_ioctl.c | 33 +++++++++++++++++++++++++++------ 3 files changed, 42 insertions(+), 14 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 90e926ef3cb1..daaa2d3cddf7 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -1341,8 +1341,12 @@ VNET_DECLARE(pflow_export_state_t *, pflow_export_state_ptr); #define V_pflow_export_state_ptr VNET(pflow_export_state_ptr) extern pfsync_detach_ifnet_t *pfsync_detach_ifnet_ptr; -void pfsync_state_export(union pfsync_state_union *, - struct pf_kstate *, int); +void pfsync_state_export_1301(struct pfsync_state_1301 *, + struct pf_kstate *); +void pfsync_state_export_1400(struct pfsync_state_1400 *, + struct pf_kstate *); +void pfsync_state_export_1500(struct pfsync_state_1500 *, + struct pf_kstate *); void pf_state_export(struct pf_state_export *, struct pf_kstate *); diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index b571734b4250..3edf08aefeb5 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -1900,25 +1900,28 @@ pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data) static void pfsync_out_state_1301(struct pf_kstate *st, void *buf) { - union pfsync_state_union *sp = buf; + struct pfsync_state_1301 *sp; - pfsync_state_export(sp, st, PFSYNC_MSG_VERSION_1301); + sp = buf; + pfsync_state_export_1301(sp, st); } static void pfsync_out_state_1400(struct pf_kstate *st, void *buf) { - union pfsync_state_union *sp = buf; + struct pfsync_state_1400 *sp; - pfsync_state_export(sp, st, PFSYNC_MSG_VERSION_1400); + sp = buf; + pfsync_state_export_1400(sp, st); } static void pfsync_out_state_1500(struct pf_kstate *st, void *buf) { - union pfsync_state_union *sp = buf; + struct pfsync_state_1500 *sp; - pfsync_state_export(sp, st, PFSYNC_MSG_VERSION_1500); + sp = buf; + pfsync_state_export_1500(sp, st); } static void diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 6774aaac2ecd..9856842c72b2 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -4118,8 +4118,7 @@ DIOCCHANGERULE_error: goto fail; } - pfsync_state_export((union pfsync_state_union*)&ps->state, - s, PFSYNC_MSG_VERSION_1301); + pfsync_state_export_1301(&ps->state, s); PF_STATE_UNLOCK(s); break; } @@ -4185,8 +4184,7 @@ DIOCGETSTATES_retry: if (s->timeout == PFTM_UNLINKED) continue; - pfsync_state_export((union pfsync_state_union*)p, - s, PFSYNC_MSG_VERSION_1301); + pfsync_state_export_1301(p, s); p++; nr++; } @@ -5795,11 +5793,10 @@ fail: return (error); } -void +static void pfsync_state_export(union pfsync_state_union *sp, struct pf_kstate *st, int msg_version) { const char *tagname; - bzero(sp, sizeof(union pfsync_state_union)); /* copy from state key */ sp->pfs_1301.key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; @@ -5932,6 +5929,30 @@ pfsync_state_export(union pfsync_state_union *sp, struct pf_kstate *st, int msg_ pf_state_counter_hton(st->bytes[1], sp->pfs_1301.bytes[1]); } +void +pfsync_state_export_1301(struct pfsync_state_1301 *sp, struct pf_kstate *st) +{ + bzero(sp, sizeof(*sp)); + pfsync_state_export((union pfsync_state_union *)sp, st, + PFSYNC_MSG_VERSION_1301); +} + +void +pfsync_state_export_1400(struct pfsync_state_1400 *sp, struct pf_kstate *st) +{ + bzero(sp, sizeof(*sp)); + pfsync_state_export((union pfsync_state_union *)sp, st, + PFSYNC_MSG_VERSION_1400); +} + +void +pfsync_state_export_1500(struct pfsync_state_1500 *sp, struct pf_kstate *st) +{ + bzero(sp, sizeof(*sp)); + pfsync_state_export((union pfsync_state_union *)sp, st, + PFSYNC_MSG_VERSION_1500); +} + void pf_state_export(struct pf_state_export *sp, struct pf_kstate *st) {