"pid 1763 (pfctl), jid 0, uid 0: exited on signal 34 (core dumped)” on boot

[rwatson]

With a hybrid kernel and CheriABI userspace on my Morello board, I get this message during the daily event each day (or when running periodic daily manually):

pid 1763 (pfctl), jid 0, uid 0: exited on signal 34 (core dumped)

This seems to be reproducible via:

root@cheribsd:/tmp # /sbin/pfctl -a "" -sr -v -z
In-address space security exception (core dumped)

[rwatson]

With gdb-cheri:

Program received signal SIGPROT, CHERI protection violation
Capability bounds fault.
0x000000000013f2a4 in main (argc=6, argv=0xffffbff7f740 [rwRW,0xffffbff7f740-0xffffbff7f7b0]) at /local/scratch/jenkins/workspace/CheriBSD-pipeline_dev/cheribsd/sbin/pfctl/pfctl.c:2776
2776	/local/scratch/jenkins/workspace/CheriBSD-pipeline_dev/cheribsd/sbin/pfctl/pfctl.c: No such file or directory.
(gdb) bt
#0  0x000000000013f2a4 in main (argc=6, argv=0xffffbff7f740 [rwRW,0xffffbff7f740-0xffffbff7f7b0])
    at /local/scratch/jenkins/workspace/CheriBSD-pipeline_dev/cheribsd/sbin/pfctl/pfctl.c:2776

Which is here in the in-sync version of pfctl.c:

        if ((path = calloc(1, MAXPATHLEN)) == NULL)
                errx(1, "pfctl: calloc");
        memset(anchorname, 0, sizeof(anchorname));
        if (anchoropt != NULL) {
                int len = strlen(anchoropt);

                if (anchoropt[len - 1] == '*') {              <--- Bounds check violation here
                        if (len >= 2 && anchoropt[len - 2] == '/')
                                anchoropt[len - 2] = '\0';
                        else
                                anchoropt[len - 1] = '\0';
                        opts |= PF_OPT_RECURSE;
                }
                if (strlcpy(anchorname, anchoropt,
                    sizeof(anchorname)) >= sizeof(anchorname))
                        errx(1, "anchor name '%s' too long",
                            anchoropt);
                loadopt &= PFCTL_FLAG_FILTER|PFCTL_FLAG_NAT|PFCTL_FLAG_TABLE|PFCTL_FLAG_ETH;
        }

And this is indeed a bounds underflow when used with -a “” -- i.e., a legit source-code bug in pfctl.c.

[rwatson]

Bug reported upstream as: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264128

[rwatson]

Exploration of a potential solution in #1386.