Date: Sat, 16 Mar 2002 13:10:22 -0800 (PST) From: Nitpicker Development Team <c.jachmann@gmx.net> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/35986: Wrong bpf-header preceading packet when using tunnel interface Message-ID: <200203162110.g2GLAMP62558@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 35986
>Category: kern
>Synopsis: Wrong bpf-header preceading packet when using tunnel interface
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Mar 16 13:20:02 PST 2002
>Closed-Date:
>Last-Modified:
>Originator: Nitpicker Development Team
>Release: 4.5-Stable
>Organization:
>Environment:
FreeBSD habbib 4.5-STABLE FreeBSD 4.5-STABLE #21: Tue Feb 19 21:11:17 CET 2002 jachmann@habbib:/usr/src/sys/compile/MY i386
>Description:
When reading from bpfbuffer, after some times the process coredumps with segmentation fault
or bus error. This problem affects libpcap as well.
gdb shows a "Bad memory address" when trying to access the next packet.
Debugging shows wrong bpfheader data:
(gdb) p bpfbuffer
$57 = 0x8112000 "\216|\223<Â\214\r"
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+0)
(gdb) p *hd
$58 = {bh_tstamp = {tv_sec = 1016298638, tv_usec = 888002}, bh_caplen = 44,
bh_datalen = 44, bh_hdrlen = 20}
(gdb) x/20 0x8112000
0x8112000: 0x3c937c8e 0x000d8cc2 0x0000002c 0x0000002c
0x8112010: 0x45470014 0x00000002 0xd4050045 0x0040399d
ippacketsize(0x8112019) tells us, packetsize would be d405 (swapped 05d4=1492)
Trusting the bpfheader, next packet is:
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+64)
(gdb) p *hd
$60 = {bh_tstamp = {tv_sec = 1763515806, tv_usec = 805317992},
bh_caplen = 3563283504, bh_datalen = 1258291218, bh_hdrlen = 16069}
Trusting the ippacket, next data would be:
(gdb) set hd=(struct bpf_hdr*)(bpfbuffer+1516)
(gdb) p *hd
$62 = {bh_tstamp = {tv_sec = 1016298638, tv_usec = 891856}, bh_caplen = 109,
bh_datalen = 109, bh_hdrlen = 20}
1516 because size(1492)+Tunnelheader(4)+bpfheader(20)
>How-To-Repeat:
Read quiete a while (several hours) from a tunnel interface and watch it coredump
>Fix:
None known
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200203162110.g2GLAMP62558>