Subject: Re: alignment crash in v6 ipfilter when receiving on gif
To: Greg Troxel <gdt@ir.bbn.com>
From: Darren Reed <darrenr@netbsd.org>
List: port-sparc64
Date: 07/10/2007 21:39:18
Greg Troxel wrote:
> Martin Husemann <martin@duskware.de> writes:
>
> > On Mon, Jul 09, 2007 at 03:02:21PM -0400, Greg Troxel wrote:
> >> fr_makefrip+0xd74:  ldx [%12 + 0x18], %g
> >
> > Well, there is at least one typo here, and the address doesn't seem to match
> > what is on the netbsd-4 branch right now - could you compile a netbsd.gdb
>
> I have IPSEC enabled, so perhaps that's why.
>
> > kernel from your unmodified source tree (add "makeoptions -g" to the config
> > file, config and make the kernel) - and then check what source line this is
> > in gdb, like "info line fr_makefrip+0xd74"?
>
> gdb on netbsd-4 didn't like that info line command, but I compiled fil.o
> with -S and matched up assembly and read the stabs and the offending
> line is:
>
> 			ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN);
> 			if (IP6_NEQ(&fin->fin_fi.fi_dst,
> 				    (i6addr_t *)&ip6->ip6_src))
> 				fin->fin_flx |= FI_BAD;
>
> So I think it is faulting fetching the ip6 address from the enclosed packet.
>   

Ok.

I think the correct thing to do is change these:

#define I60(x)  (((i6addr_t *)(x))->i6[0])
#define I61(x)  (((i6addr_t *)(x))->i6[1])
#define I62(x)  (((i6addr_t *)(x))->i6[2])
#define I63(x)  (((i6addr_t *)(x))->i6[3])
#define HI60(x) ntohl(((i6addr_t *)(x))->i6[0])
#define HI61(x) ntohl(((i6addr_t *)(x))->i6[1])
#define HI62(x) ntohl(((i6addr_t *)(x))->i6[2])
#define HI63(x) ntohl(((i6addr_t *)(x))->i6[3])

to be:

#define I60(x)  (((u_32_t *)(x))[0])
#define I61(x)  (((u_32_t *)(x))[1])
#define I62(x)  (((u_32_t*)(x))[2])
#define I63(x)  (((u_32_t *)(x))[3])
#define HI60(x) ntohl(((u_32_t *)(x))[0])
#define HI61(x) ntohl(((u_32_t *)(x))[1])
#define HI62(x) ntohl(((u_32_t *)(x))[2])
#define HI63(x) ntohl(((u_32_t *)(x))[3])

Let me know if this works for you, in place of the other patch
to use memcmp and a temporary variable.

Darren