[PATCH v2] bpf: bpf_dbg: fix off-by-one in cmd_select

[Hasan Basbunar]

bpf_dbg's interactive 'select <N>' command, documented in the file
header ("select 3 (run etc will start from the 3rd packet in the
pcap)") to use 1-based packet indexing, advances the pcap cursor one
packet too many. The loop in cmd_select():

	pcap_reset_pkt();         /* cursor on packet 1 */
	for (i = 0; i < which && (have_next = pcap_next_pkt()); i++)
		/* noop */;

calls pcap_next_pkt() N times to reach packet N, but pcap_next_pkt()
validates the packet at the cursor and then advances past it. After
N calls the cursor is on packet N+1, so 'select 3' positions on
packet 4, 'select 4' on packet 5, etc. To land on packet N the loop
must advance the cursor only N-1 times.

Reproduction (deterministic, no kernel needed): build bpf_dbg from
the unmodified tree, synthesize a pcap with N>=2 packets each with
a distinct payload byte, and drive 'select 1 / step 1 / quit'.
Before this fix, 'select 1' shows packet 2's payload. After this
fix, 'select K' shows packet K for all K in 1..N, and 'select N+1'
correctly errors with "no packet #N+1 available!".

Cloudflare's downstream mirror at github.com/cloudflare/bpftools
carries the same defect.

Fixes: fd981e3c321a ("filter: bpf_dbg: add minimal bpf debugger")
Signed-off-by: Hasan Basbunar <basbunarhasan@xxxxxxxxx>
---
Changes in v2:
 - Drop the pcap_next_pkt() boundary change (>= -> >). As correctly
   pointed out by Sashiko AI on the v1 thread, that change was wrong:
   when the last packet body ends exactly at the mmap boundary (the
   common case for pcap files with no trailer), the relaxed check let
   pcap_next_pkt() advance the cursor to pcap_ptr_va_start +
   pcap_map_size and return true. The cmd_run() do/while loop then
   re-entered its body, called pcap_curr_pkt() at end-of-mmap, and
   bpf_run_all() dereferenced hdr->caplen / hdr->len out of bounds.
   The original >= comparison is correct: when the body ends at the
   boundary it returns false without advancing, and the loop exits
   cleanly. The cmd_select() 1-based fix below is sufficient and
   self-contained; pcap_next_pkt() is left untouched.
 - v1: https://lore.kernel.org/bpf/20260428100109.56572-1-basbunarhasan@xxxxxxxxx/

 tools/bpf/bpf_dbg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c
index 00e560a17baf..4895602ab37d 100644
--- a/tools/bpf/bpf_dbg.c
+++ b/tools/bpf/bpf_dbg.c
@@ -1141,7 +1141,7 @@ static int cmd_select(char *num)
 	pcap_reset_pkt();
 	bpf_reset();
 
-	for (i = 0; i < which && (have_next = pcap_next_pkt()); i++)
+	for (i = 1; i < which && (have_next = pcap_next_pkt()); i++)
 		/* noop */;
 	if (!have_next || pcap_curr_pkt() == NULL) {
 		rl_printf("no packet #%u available!\n", which);
-- 
2.53.0