On Tue, 27 Oct 2026 10:06:19 -0700
Stephen Hemminger <[email protected]> wrote:
> Classic BPF filters using a variable offset into the packet, such as
> "tcp[tcpflags] & tcp-syn != 0" or "tcp[0:4] = ...", read the wrong bytes.
>
> The indirect loads ldb/ld [x + k] were handled in the same case as the
> arithmetic instructions, which take the source register from
> BPF_SRC(code), that is bit 0x08. In a load opcode that bit is part of
> the size field, not a K/X selector, so BPF_LD|BPF_IND|BPF_B (0x50) and
> BPF_LD|BPF_IND|BPF_W (0x40) both yield BPF_K and the index register
> becomes R0 (A) instead of R7 (X). The halfword form works only because
> BPF_H and BPF_X are both 0x08.
>
> Give the indirect loads their own case next to the absolute loads and
> emit X as the index register. The interpreter and the JITs already
> take the index from src_reg, so this fixes all engines.
>
> Bugzilla ID: 2085
> Fixes: 2eccf6afbea9 ("bpf: add function to convert classic BPF to DPDK BPF")
> Cc: [email protected]
>
> Signed-off-by: Stephen Hemminger <[email protected]>
> ---
Reported-by: Anthropic OSS scanner (ANT-2026-O029C471)
