bge: Avoid accessing invalid internal memory region on BCM5906
[dragonfly.git] / sys / net / bpf_filter.c
1 /*
2  * Copyright (c) 1990, 1991, 1993
3  *      The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *      This product includes software developed by the University of
21  *      California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      @(#)bpf_filter.c        8.1 (Berkeley) 6/10/93
39  *
40  * $FreeBSD: src/sys/net/bpf_filter.c,v 1.17 1999/12/29 04:38:31 peter Exp $
41  */
42
43 #include <sys/systm.h>
44 #include <sys/param.h>
45
46 #if defined(sparc) || defined(mips) || defined(ibm032)
47 #define BPF_ALIGN
48 #endif
49
50 #ifndef BPF_ALIGN
51 #define EXTRACT_SHORT(p)        ((u_int16_t)ntohs(*(u_int16_t *)p))
52 #define EXTRACT_LONG(p)         (ntohl(*(u_int32_t *)p))
53 #else
54 #define EXTRACT_SHORT(p)\
55         ((u_int16_t)\
56                 ((u_int16_t)*((u_char *)p+0)<<8|\
57                  (u_int16_t)*((u_char *)p+1)<<0))
58 #define EXTRACT_LONG(p)\
59                 ((u_int32_t)*((u_char *)p+0)<<24|\
60                  (u_int32_t)*((u_char *)p+1)<<16|\
61                  (u_int32_t)*((u_char *)p+2)<<8|\
62                  (u_int32_t)*((u_char *)p+3)<<0)
63 #endif
64
65 #ifdef _KERNEL
66 #include <sys/mbuf.h>
67 #endif
68 #include <net/bpf.h>
69 #ifdef _KERNEL
70 #define MINDEX(m, k)                                                    \
71 {                                                                       \
72         int len = m->m_len;                                             \
73                                                                         \
74         while (k >= len) {                                              \
75                 k -= len;                                               \
76                 m = m->m_next;                                          \
77                 if (m == 0)                                             \
78                         return 0;                                       \
79                 len = m->m_len;                                         \
80         }                                                               \
81 }
82
83 extern int      bpf_maxbufsize;
84
85 static u_int16_t        m_xhalf (struct mbuf *m, bpf_u_int32 k, int *err);
86 static u_int32_t        m_xword (struct mbuf *m, bpf_u_int32 k, int *err);
87
88 static u_int32_t
89 m_xword(struct mbuf *m, bpf_u_int32 k, int *err)
90 {
91         size_t len;
92         u_char *cp, *np;
93         struct mbuf *m0;
94
95         len = m->m_len;
96         while (k >= len) {
97                 k -= len;
98                 m = m->m_next;
99                 if (m == NULL)
100                         goto bad;
101                 len = m->m_len;
102         }
103         cp = mtod(m, u_char *) + k;
104         if (len - k >= 4) {
105                 *err = 0;
106                 return EXTRACT_LONG(cp);
107         }
108         m0 = m->m_next;
109         if (m0 == NULL || m0->m_len + len - k < 4)
110                 goto bad;
111         *err = 0;
112         np = mtod(m0, u_char *);
113         switch (len - k) {
114
115         case 1:
116                 return
117                     ((u_int32_t)cp[0] << 24) |
118                     ((u_int32_t)np[0] << 16) |
119                     ((u_int32_t)np[1] << 8)  |
120                     (u_int32_t)np[2];
121
122         case 2:
123                 return
124                     ((u_int32_t)cp[0] << 24) |
125                     ((u_int32_t)cp[1] << 16) |
126                     ((u_int32_t)np[0] << 8) |
127                     (u_int32_t)np[1];
128
129         default:
130                 return
131                     ((u_int32_t)cp[0] << 24) |
132                     ((u_int32_t)cp[1] << 16) |
133                     ((u_int32_t)cp[2] << 8) |
134                     (u_int32_t)np[0];
135         }
136     bad:
137         *err = 1;
138         return 0;
139 }
140
141 static u_int16_t
142 m_xhalf(struct mbuf *m, bpf_u_int32 k, int *err)
143 {
144         size_t len;
145         u_char *cp;
146         struct mbuf *m0;
147
148         len = m->m_len;
149         while (k >= len) {
150                 k -= len;
151                 m = m->m_next;
152                 if (m == NULL)
153                         goto bad;
154                 len = m->m_len;
155         }
156         cp = mtod(m, u_char *) + k;
157         if (len - k >= 2) {
158                 *err = 0;
159                 return EXTRACT_SHORT(cp);
160         }
161         m0 = m->m_next;
162         if (m0 == NULL)
163                 goto bad;
164         *err = 0;
165         return (cp[0] << 8) | mtod(m0, u_char *)[0];
166  bad:
167         *err = 1;
168         return 0;
169 }
170 #endif
171
172 /*
173  * Execute the filter program starting at pc on the packet p
174  * wirelen is the length of the original packet
175  * buflen is the amount of data present
176  */
177 u_int
178 bpf_filter(const struct bpf_insn *pc, u_char *p, u_int wirelen, u_int buflen)
179 {
180         u_int32_t A = 0, X = 0;
181         bpf_u_int32 k;
182         int32_t mem[BPF_MEMWORDS];
183
184         bzero(mem, sizeof(mem));
185
186         if (pc == NULL) {
187                 /*
188                  * No filter means accept all.
189                  */
190                 return (u_int)-1;
191         }
192
193         --pc;
194         while (1) {
195                 ++pc;
196                 switch (pc->code) {
197
198                 default:
199 #ifdef _KERNEL
200                         return 0;
201 #else
202                         abort();
203 #endif
204                 case BPF_RET|BPF_K:
205                         return (u_int)pc->k;
206
207                 case BPF_RET|BPF_A:
208                         return (u_int)A;
209
210                 case BPF_LD|BPF_W|BPF_ABS:
211                         k = pc->k;
212                         if (k > buflen || sizeof(int32_t) > buflen - k) {
213 #ifdef _KERNEL
214                                 int merr;
215
216                                 if (buflen != 0)
217                                         return 0;
218                                 A = m_xword((struct mbuf *)p, k, &merr);
219                                 if (merr != 0)
220                                         return 0;
221                                 continue;
222 #else
223                                 return 0;
224 #endif
225                         }
226 #ifdef BPF_ALIGN
227                         if (((intptr_t)(p + k) & 3) != 0)
228                                 A = EXTRACT_LONG(&p[k]);
229                         else
230 #endif
231                                 A = ntohl(*(int32_t *)(p + k));
232                         continue;
233
234                 case BPF_LD|BPF_H|BPF_ABS:
235                         k = pc->k;
236                         if (k > buflen || sizeof(int16_t) > buflen - k) {
237 #ifdef _KERNEL
238                                 int merr;
239
240                                 if (buflen != 0)
241                                         return 0;
242                                 A = m_xhalf((struct mbuf *)p, k, &merr);
243                                 continue;
244 #else
245                                 return 0;
246 #endif
247                         }
248                         A = EXTRACT_SHORT(&p[k]);
249                         continue;
250
251                 case BPF_LD|BPF_B|BPF_ABS:
252                         k = pc->k;
253                         if (k >= buflen) {
254 #ifdef _KERNEL
255                                 struct mbuf *m;
256
257                                 if (buflen != 0)
258                                         return 0;
259                                 m = (struct mbuf *)p;
260                                 MINDEX(m, k);
261                                 A = mtod(m, u_char *)[k];
262                                 continue;
263 #else
264                                 return 0;
265 #endif
266                         }
267                         A = p[k];
268                         continue;
269
270                 case BPF_LD|BPF_W|BPF_LEN:
271                         A = wirelen;
272                         continue;
273
274                 case BPF_LDX|BPF_W|BPF_LEN:
275                         X = wirelen;
276                         continue;
277
278                 case BPF_LD|BPF_W|BPF_IND:
279                         k = X + pc->k;
280                         if (pc->k > buflen || X > buflen - pc->k ||
281                             sizeof(int32_t) > buflen - k) {
282 #ifdef _KERNEL
283                                 int merr;
284
285                                 if (buflen != 0)
286                                         return 0;
287                                 A = m_xword((struct mbuf *)p, k, &merr);
288                                 if (merr != 0)
289                                         return 0;
290                                 continue;
291 #else
292                                 return 0;
293 #endif
294                         }
295 #ifdef BPF_ALIGN
296                         if (((intptr_t)(p + k) & 3) != 0)
297                                 A = EXTRACT_LONG(&p[k]);
298                         else
299 #endif
300                                 A = ntohl(*(int32_t *)(p + k));
301                         continue;
302
303                 case BPF_LD|BPF_H|BPF_IND:
304                         k = X + pc->k;
305                         if (X > buflen || pc->k > buflen - X ||
306                             sizeof(int16_t) > buflen - k) {
307 #ifdef _KERNEL
308                                 int merr;
309
310                                 if (buflen != 0)
311                                         return 0;
312                                 A = m_xhalf((struct mbuf *)p, k, &merr);
313                                 if (merr != 0)
314                                         return 0;
315                                 continue;
316 #else
317                                 return 0;
318 #endif
319                         }
320                         A = EXTRACT_SHORT(&p[k]);
321                         continue;
322
323                 case BPF_LD|BPF_B|BPF_IND:
324                         k = X + pc->k;
325                         if (pc->k >= buflen || X >= buflen - pc->k) {
326 #ifdef _KERNEL
327                                 struct mbuf *m;
328
329                                 if (buflen != 0)
330                                         return 0;
331                                 m = (struct mbuf *)p;
332                                 MINDEX(m, k);
333                                 A = mtod(m, u_char *)[k];
334                                 continue;
335 #else
336                                 return 0;
337 #endif
338                         }
339                         A = p[k];
340                         continue;
341
342                 case BPF_LDX|BPF_MSH|BPF_B:
343                         k = pc->k;
344                         if (k >= buflen) {
345 #ifdef _KERNEL
346                                 struct mbuf *m;
347
348                                 if (buflen != 0)
349                                         return 0;
350                                 m = (struct mbuf *)p;
351                                 MINDEX(m, k);
352                                 X = (mtod(m, char *)[k] & 0xf) << 2;
353                                 continue;
354 #else
355                                 return 0;
356 #endif
357                         }
358                         X = (p[pc->k] & 0xf) << 2;
359                         continue;
360
361                 case BPF_LD|BPF_IMM:
362                         A = pc->k;
363                         continue;
364
365                 case BPF_LDX|BPF_IMM:
366                         X = pc->k;
367                         continue;
368
369                 case BPF_LD|BPF_MEM:
370                         A = mem[pc->k];
371                         continue;
372
373                 case BPF_LDX|BPF_MEM:
374                         X = mem[pc->k];
375                         continue;
376
377                 case BPF_ST:
378                         mem[pc->k] = A;
379                         continue;
380
381                 case BPF_STX:
382                         mem[pc->k] = X;
383                         continue;
384
385                 case BPF_JMP|BPF_JA:
386                         pc += pc->k;
387                         continue;
388
389                 case BPF_JMP|BPF_JGT|BPF_K:
390                         pc += (A > pc->k) ? pc->jt : pc->jf;
391                         continue;
392
393                 case BPF_JMP|BPF_JGE|BPF_K:
394                         pc += (A >= pc->k) ? pc->jt : pc->jf;
395                         continue;
396
397                 case BPF_JMP|BPF_JEQ|BPF_K:
398                         pc += (A == pc->k) ? pc->jt : pc->jf;
399                         continue;
400
401                 case BPF_JMP|BPF_JSET|BPF_K:
402                         pc += (A & pc->k) ? pc->jt : pc->jf;
403                         continue;
404
405                 case BPF_JMP|BPF_JGT|BPF_X:
406                         pc += (A > X) ? pc->jt : pc->jf;
407                         continue;
408
409                 case BPF_JMP|BPF_JGE|BPF_X:
410                         pc += (A >= X) ? pc->jt : pc->jf;
411                         continue;
412
413                 case BPF_JMP|BPF_JEQ|BPF_X:
414                         pc += (A == X) ? pc->jt : pc->jf;
415                         continue;
416
417                 case BPF_JMP|BPF_JSET|BPF_X:
418                         pc += (A & X) ? pc->jt : pc->jf;
419                         continue;
420
421                 case BPF_ALU|BPF_ADD|BPF_X:
422                         A += X;
423                         continue;
424
425                 case BPF_ALU|BPF_SUB|BPF_X:
426                         A -= X;
427                         continue;
428
429                 case BPF_ALU|BPF_MUL|BPF_X:
430                         A *= X;
431                         continue;
432
433                 case BPF_ALU|BPF_DIV|BPF_X:
434                         if (X == 0)
435                                 return 0;
436                         A /= X;
437                         continue;
438
439                 case BPF_ALU|BPF_AND|BPF_X:
440                         A &= X;
441                         continue;
442
443                 case BPF_ALU|BPF_OR|BPF_X:
444                         A |= X;
445                         continue;
446
447                 case BPF_ALU|BPF_LSH|BPF_X:
448                         A <<= X;
449                         continue;
450
451                 case BPF_ALU|BPF_RSH|BPF_X:
452                         A >>= X;
453                         continue;
454
455                 case BPF_ALU|BPF_ADD|BPF_K:
456                         A += pc->k;
457                         continue;
458
459                 case BPF_ALU|BPF_SUB|BPF_K:
460                         A -= pc->k;
461                         continue;
462
463                 case BPF_ALU|BPF_MUL|BPF_K:
464                         A *= pc->k;
465                         continue;
466
467                 case BPF_ALU|BPF_DIV|BPF_K:
468                         A /= pc->k;
469                         continue;
470
471                 case BPF_ALU|BPF_AND|BPF_K:
472                         A &= pc->k;
473                         continue;
474
475                 case BPF_ALU|BPF_OR|BPF_K:
476                         A |= pc->k;
477                         continue;
478
479                 case BPF_ALU|BPF_LSH|BPF_K:
480                         A <<= pc->k;
481                         continue;
482
483                 case BPF_ALU|BPF_RSH|BPF_K:
484                         A >>= pc->k;
485                         continue;
486
487                 case BPF_ALU|BPF_NEG:
488                         A = -A;
489                         continue;
490
491                 case BPF_MISC|BPF_TAX:
492                         X = A;
493                         continue;
494
495                 case BPF_MISC|BPF_TXA:
496                         A = X;
497                         continue;
498                 }
499         }
500 }
501
502 #ifdef _KERNEL
503 /*
504  * Return true if the 'fcode' is a valid filter program.
505  * The constraints are that each jump be forward and to a valid
506  * code, that memory accesses are within valid ranges (to the
507  * extent that this can be checked statically; loads of packet
508  * data have to be, and are, also checked at run time), and that
509  * the code terminates with either an accept or reject.
510  *
511  * The kernel needs to be able to verify an application's filter code.
512  * Otherwise, a bogus program could easily crash the system.
513  */
514 int
515 bpf_validate(const struct bpf_insn *f, int len)
516 {
517         u_int i, from;
518         const struct bpf_insn *p;
519
520         if (len < 1 || len > BPF_MAXINSNS)
521                 return 0;
522
523         for (i = 0; i < len; ++i) {
524                 p = &f[i];
525                 switch (BPF_CLASS(p->code)) {
526                 /*
527                  * Check that memory operations use valid addresses.
528                  */
529                 case BPF_LD:
530                 case BPF_LDX:
531                         switch (BPF_MODE(p->code)) {
532                         case BPF_IMM:
533                                 break;
534                         case BPF_ABS:
535                         case BPF_IND:
536                         case BPF_MSH:
537                                 /*
538                                  * More strict check with actual packet length
539                                  * is done runtime.
540                                  */
541                                 if (p->k >= bpf_maxbufsize)
542                                         return 0;
543                                 break;
544                         case BPF_MEM:
545                                 if (p->k >= BPF_MEMWORDS)
546                                         return 0;
547                                 break;
548                         case BPF_LEN:
549                                 break;
550                         default:
551                                 return 0;
552                         }
553                         break;
554                 case BPF_ST:
555                 case BPF_STX:
556                         if (p->k >= BPF_MEMWORDS)
557                                 return 0;
558                         break;
559                 case BPF_ALU:
560                         switch (BPF_OP(p->code)) {
561                         case BPF_ADD:
562                         case BPF_SUB:
563                         case BPF_MUL:
564                         case BPF_OR:
565                         case BPF_AND:
566                         case BPF_LSH:
567                         case BPF_RSH:
568                         case BPF_NEG:
569                                 break;
570                         case BPF_DIV:
571                                 /*
572                                  * Check for constant division by 0.
573                                  */
574                                 if (BPF_SRC(p->code) == BPF_K && p->k == 0)
575                                         return 0;
576                                 break;
577                         default:
578                                 return 0;
579                         }
580                         break;
581                 case BPF_JMP:
582                         /*
583                          * Check that jumps are within the code block,
584                          * and that unconditional branches don't go
585                          * backwards as a result of an overflow.
586                          * Unconditional branches have a 32-bit offset,
587                          * so they could overflow; we check to make
588                          * sure they don't.  Conditional branches have
589                          * an 8-bit offset, and the from address is <=
590                          * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
591                          * is sufficiently small that adding 255 to it
592                          * won't overflow.
593                          *
594                          * We know that len is <= BPF_MAXINSNS, and we
595                          * assume that BPF_MAXINSNS is < the maximum size
596                          * of a u_int, so that i + 1 doesn't overflow.
597                          */
598                         from = i + 1;
599                         switch (BPF_OP(p->code)) {
600                         case BPF_JA:
601                                 if (from + p->k < from || from + p->k >= len)
602                                         return 0;
603                                 break;
604                         case BPF_JEQ:
605                         case BPF_JGT:
606                         case BPF_JGE:
607                         case BPF_JSET:
608                                 if (from + p->jt >= len || from + p->jf >= len)
609                                         return 0;
610                                 break;
611                         default:
612                                 return 0;
613                         }
614                         break;
615                 case BPF_RET:
616                         break;
617                 case BPF_MISC:
618                         break;
619                 default:
620                         return 0;
621                 }
622         }
623         return BPF_CLASS(f[len - 1].code) == BPF_RET;
624 }
625 #endif