CVS commit: src/sys/net/npf

["Alexander Nasonov" <alnsn%netbsd.org@localhost>]

Module Name:    src
Committed By:   alnsn
Date:           Sat Nov  7 17:22:58 UTC 2026

Modified Files:
        src/sys/net/npf: npf_ruleset.c

Log Message:
Pass a number of bpf_insn to npf_bpf_compile, this should fix kern/60975.

Contrary to what the PR says, it broke loudly only in -current
when I tightened checks in bpfjit_generate_code on July 5th, 2026.

In stable releases it reads past the end of allocations but it generates
valid jitted code.

Why it works in stable releases:

  - bpf_validate() checks that a rule ends with a valid RET and
    that jumps don't jump past the last RET,
  - bpfjit in stable releases doesn't check for a valid RET, it
    relies on bpf_validate().
  - bpfjit starts by (over)allocating a shadow bpfjit_insn array,
    then scans (and goes past the end) instructions, builds CFG
    and sets the "unreachable" flag in the shadow array. All
    instructions after the last RET have unreachable set to true.
  - bpfjit skips emitting any code when unreachable is true
    without even reading those instructions.

The above logic broke after this change:

 - Fail unless the last instruction is BPF_RET+BPF_A or BPF_RET+BPF_K.


To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.59 src/sys/net/npf/npf_ruleset.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.