Re: kern/60491: arp creates state for invalid messages

["Taylor R Campbell via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60491; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: Thomas Klausner <wiz%NetBSD.org@localhost>,
	Manuel Bouyer <bouyer%antioche.eu.org@localhost>
Cc: gnats-bugs%NetBSD.org@localhost, netbsd-bugs%NetBSD.org@localhost
Subject: Re: kern/60491: arp creates state for invalid messages
Date: Fri, 16 Oct 2026 15:23:01 +0000

 This is a multi-part message in MIME format.
 --=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk
 
 Can you please try to reproduce it with the attached patch?  Should
 help to narrow down where things are going wrong.
 
 --=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk
 Content-Type: text/plain; charset="ISO-8859-1"; name="pr60491-arpcrashdiag"
 Content-Transfer-Encoding: quoted-printable
 Content-Disposition: attachment; filename="pr60491-arpcrashdiag.patch"
 
 # HG changeset patch
 # User Taylor R Campbell <riastradh%NetBSD.org@localhost>
 # Date 1792164105 0
 #      Fri Oct 16 15:21:45 2026 +0000
 # Branch trunk
 # Node ID adab6b9c88cde7ef98ff7436dc06bece8350063f
 # Parent  8fabf8640a9ac16011ccfe817764973287f81e77
 # EXP-Topic riastradh-pr60491-arpvalidation
 WIP: if_arp: Add diagnostics for crash.
 
 PR kern/60491: arp creates state for invalid messages
 
 diff -r 8fabf8640a9a -r adab6b9c88cd sys/netinet/if_arp.c
 --- a/sys/netinet/if_arp.c	Thu Oct 08 00:06:04 2026 +0000
 +++ b/sys/netinet/if_arp.c	Fri Oct 16 15:21:45 2026 +0000
 @@ -742,6 +742,8 @@ arpintr(void *arg __unused)
  				ARP_STATINC(ARP_STAT_RCVBADPROTO);
  				goto free;
  			}
 +			KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
 +			    ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
  			in_arpinput(m);
  			continue;
  		default:
 @@ -794,6 +796,8 @@ in_arpinput(struct mbuf *m)
  	char ipbuf[INET_ADDRSTRLEN];
  	bool find_source, do_dad;
 =20
 +	KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
 +	    ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
  	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
  		goto out;
  	ah =3D mtod(m, struct arphdr *);
 @@ -1895,7 +1899,11 @@ in_revarpinput(struct mbuf *m)
  	switch (op) {
  	case ARPOP_REQUEST:
  	case ARPOP_REPLY:	/* per RFC */
 +		KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
 +		    ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
  		m_put_rcvif(rcvif, &s);
 +		KASSERT(ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REPLY ||
 +		    ntohs(mtod(m, struct arphdr *)->ar_op) =3D=3D ARPOP_REQUEST);
  		in_arpinput(m);
  		return;
  	case ARPOP_REVREPLY:
 
 --=_tVq9BOFzAnpXS9N5Qy8XBZQoi+hFOgDk--