From 9842ed8859172c3553bc3d833fec8bca73256ea6 Mon Sep 17 00:00:00 2001
From: Gordon Tetlow <gordon@FreeBSD.org>
Date: Thu, 19 Mar 2020 16:49:32 +0000
Subject: [PATCH] Fix insufficient ixl(4) ioctl(2) privilege checking.

Approved by:	so
Security:	FreeBSD-SA-20:06.if_ixl_ioctl
Security:	CVE-2019-15877
---
 sys/dev/ixl/if_ixl.c | 28 +++++++++++++++++++++++-----
 sys/dev/ixl/ixl.h    |  1 +
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/sys/dev/ixl/if_ixl.c b/sys/dev/ixl/if_ixl.c
index ed1513f3a51..d3e3f5e2b64 100644
--- a/sys/dev/ixl/if_ixl.c
+++ b/sys/dev/ixl/if_ixl.c
@@ -1625,11 +1625,29 @@ ixl_if_priv_ioctl(if_ctx_t ctx, u_long command, caddr_t data)
 	struct ifdrv *ifd = (struct ifdrv *)data;
 	int error = 0;
 
-	/* NVM update command */
-	if (ifd->ifd_cmd == I40E_NVM_ACCESS)
-		error = ixl_handle_nvmupd_cmd(pf, ifd);
-	else
-		error = EINVAL;
+	/*
+	 * The iflib_if_ioctl forwards SIOCxDRVSPEC and SIOGPRIVATE_0 without
+	 * performing privilege checks. It is important that this function
+	 * perform the necessary checks for commands which should only be
+	 * executed by privileged threads.
+	 */
+
+	switch(command) {
+	case SIOCGDRVSPEC:
+	case SIOCSDRVSPEC:
+		/* NVM update command */
+		if (ifd->ifd_cmd == I40E_NVM_ACCESS) {
+			error = priv_check(curthread, PRIV_DRIVER);
+			if (error)
+				break;
+			error = ixl_handle_nvmupd_cmd(pf, ifd);
+		} else {
+			error = EINVAL;
+		}
+		break;
+	default:
+		error = EOPNOTSUPP;
+	}
 
 	return (error);
 }
diff --git a/sys/dev/ixl/ixl.h b/sys/dev/ixl/ixl.h
index d38f391cf92..41d682dadfe 100644
--- a/sys/dev/ixl/ixl.h
+++ b/sys/dev/ixl/ixl.h
@@ -52,6 +52,7 @@
 #include <sys/sockio.h>
 #include <sys/eventhandler.h>
 #include <sys/syslog.h>
+#include <sys/priv.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
-- 
2.45.0