svn commit: r356309 - head/sys/dev/ixl

[Eric Joyner]

Author: erj
Date: Thu Jan  2 23:24:57 2020
New Revision: 356309
URL: https://svnweb.freebsd.org/changeset/base/356309

Log:
  ixl: prevent non-privileged access to NVM update interface
  
  Add a privilege check to the ixl_handle_nvmupd_cmd function, ensuring
  that only privileged users are allowed to access the NVM update
  interface.
  
  Signed-off-by: Jacob Keller <jacob.e.keller at intel.com>
  
  Submitted by:	Jacob Keller <jacob.e.keller at intel.com>
  Reported by:	markj@
  Reviewed by:	markj@, erj@, jeffrey.e.pieper at intel.com
  MFC after:	3 days
  Sponsored by:	Intel Corporation
  Differential Revision:	https://reviews.freebsd.org/D22870

Modified:
  head/sys/dev/ixl/if_ixl.c
  head/sys/dev/ixl/ixl.h

Modified: head/sys/dev/ixl/if_ixl.c
==============================================================================
--- head/sys/dev/ixl/if_ixl.c	Thu Jan  2 23:20:37 2020	(r356308)
+++ head/sys/dev/ixl/if_ixl.c	Thu Jan  2 23:24:57 2020	(r356309)
@@ -1624,11 +1624,29 @@ ixl_if_priv_ioctl(if_ctx_t ctx, u_long command, caddr_
 	struct ifdrv *ifd = (struct ifdrv *)data;
 	int error = 0;
 
-	/* NVM update command */
-	if (ifd->ifd_cmd == I40E_NVM_ACCESS)
-		error = ixl_handle_nvmupd_cmd(pf, ifd);
-	else
-		error = EINVAL;
+	/*
+	 * The iflib_if_ioctl forwards SIOCxDRVSPEC and SIOGPRIVATE_0 without
+	 * performing privilege checks. It is important that this function
+	 * perform the necessary checks for commands which should only be
+	 * executed by privileged threads.
+	 */
+
+	switch(command) {
+	case SIOCGDRVSPEC:
+	case SIOCSDRVSPEC:
+		/* NVM update command */
+		if (ifd->ifd_cmd == I40E_NVM_ACCESS) {
+			error = priv_check(curthread, PRIV_DRIVER);
+			if (error)
+				break;
+			error = ixl_handle_nvmupd_cmd(pf, ifd);
+		} else {
+			error = EINVAL;
+		}
+		break;
+	default:
+		error = EOPNOTSUPP;
+	}
 
 	return (error);
 }

Modified: head/sys/dev/ixl/ixl.h
==============================================================================
--- head/sys/dev/ixl/ixl.h	Thu Jan  2 23:20:37 2020	(r356308)
+++ head/sys/dev/ixl/ixl.h	Thu Jan  2 23:24:57 2020	(r356309)
@@ -52,6 +52,7 @@
 #include <sys/sockio.h>
 #include <sys/eventhandler.h>
 #include <sys/syslog.h>
+#include <sys/priv.h>
 
 #include <net/if.h>
 #include <net/if_var.h>