Page MenuHomeFreeBSD

if_output: validate sa_len before reading sa_data for BPF address family
Needs ReviewPublic

Authored by ing.castellanosdz_gmail.com on Mon, Aug 24, 6:37 AM.
Tags
None
Referenced Files
F167839775: D59140.diff
Mon, Aug 24, 10:17 PM
F167834575: D59140.id184869.diff
Mon, Aug 24, 9:13 PM
F167789416: D59140.id.diff
Mon, Aug 24, 1:36 PM
F167789136: D59140.id.diff
Mon, Aug 24, 1:32 PM
F167770650: D59140.id184869.diff
Mon, Aug 24, 10:18 AM
F167768484: D59140.diff
Mon, Aug 24, 9:52 AM

Details

Reviewers
jhb
bz
Summary

Several if_output implementations (tuntap, me, gif, disc, loop) read
dst->sa_data into an address family variable via bcopy/memcpy without
verifying that dst->sa_len >= sizeof(af) first. When called via
bpfwrite() with DLT_RAW, dst is zero-initialized and sa_len is 0,
resulting in af=0 passed silently to BPF_MTAP2.

Add an explicit sa_len check before the copy. If sa_len is
insufficient, af defaults to 0 rather than reading beyond the
valid buffer range.

MFC after: 2 weeks

Test Plan

Observed on FreeBSD 14.4-RELEASE-p8 with Tailscale tun interface (DLT_NULL).
Pattern verified in HEAD across all five files via source audit.
bpfwrite() path confirmed: bzero(&dst) at line 1211, sa_len=0 after
bpf_movein(DLT_RAW), activates AF_UNSPEC branch in each driver.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 76045
Build 72928: arc lint + arc unit