From 41be1ee6378a1aa754f6755274e442352db1fc85 Mon Sep 17 00:00:00 2001
From: hselasky <hselasky@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Fri, 8 Dec 2017 15:26:57 +0000
Subject: [PATCH] MFC r326362: Disallow TUN and TAP character device IOCTLs to
 modify the network device type to any value. This can cause page faults and
 panics due to accessing uninitialized fields in the "struct ifnet" which are
 specific to the network device type.

Found by:	jau@iki.fi
PR:		223767
Sponsored by:	Mellanox Technologies


git-svn-id: svn://svn.freebsd.org/base/stable/10@326692 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 share/man/man4/tap.4 | 11 +++++++++--
 share/man/man4/tun.4 | 11 +++++++++--
 sys/net/if_tap.c     |  3 ++-
 sys/net/if_tun.c     |  3 ++-
 4 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/share/man/man4/tap.4 b/share/man/man4/tap.4
index 229de6028..89defdaae 100644
--- a/share/man/man4/tap.4
+++ b/share/man/man4/tap.4
@@ -1,7 +1,7 @@
 .\" $FreeBSD$
 .\" Based on PR#2411
 .\"
-.Dd November 30, 2014
+.Dd November 29, 2017
 .Dt TAP 4
 .Os
 .Sh NAME
@@ -171,7 +171,14 @@ calls are supported
 .In net/if_tap.h ) :
 .Bl -tag -width VMIO_SIOCSETMACADDR
 .It Dv TAPSIFINFO
-Set network interface information (line speed, MTU and type).
+Set network interface information (line speed and MTU).
+The type must be the same as returned by
+.Dv TAPGIFINFO
+or set to
+.Dv IFT_ETHER
+else the
+.Xr ioctl 2
+call will fail.
 The argument should be a pointer to a
 .Va struct tapinfo .
 .It Dv TAPGIFINFO
diff --git a/share/man/man4/tun.4 b/share/man/man4/tun.4
index 0b88b7213..4e58eb825 100644
--- a/share/man/man4/tun.4
+++ b/share/man/man4/tun.4
@@ -2,7 +2,7 @@
 .\" $FreeBSD$
 .\" Based on PR#2411
 .\"
-.Dd November 30, 2014
+.Dd November 29, 2017
 .Dt TUN 4
 .Os
 .Sh NAME
@@ -208,8 +208,15 @@ this stores the internal debugging variable's value into it.
 .It Dv TUNSIFINFO
 The argument should be a pointer to an
 .Vt struct tuninfo
-and allows setting the MTU, the type, and the baudrate of the tunnel
+and allows setting the MTU and the baudrate of the tunnel
 device.
+The type must be the same as returned by
+.Dv TUNGIFINFO
+or set to
+.Dv IFT_PPP
+else the
+.Xr ioctl 2
+call will fail.
 The
 .Vt struct tuninfo
 is declared in
diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c
index 62005a3a9..c6b19a28a 100644
--- a/sys/net/if_tap.c
+++ b/sys/net/if_tap.c
@@ -736,9 +736,10 @@ tapioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td
 	switch (cmd) {
 		case TAPSIFINFO:
 			tapp = (struct tapinfo *)data;
+			if (ifp->if_type != tapp->type)
+				return (EPROTOTYPE);
 			mtx_lock(&tp->tap_mtx);
 			ifp->if_mtu = tapp->mtu;
-			ifp->if_type = tapp->type;
 			ifp->if_baudrate = tapp->baudrate;
 			mtx_unlock(&tp->tap_mtx);
 			break;
diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index 262d6d2f9..5a76f8bb9 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -677,9 +677,10 @@ tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag,
 			if (error)
 				return (error);
 		}
+		if (TUN2IFP(tp)->if_type != tunp->type)
+			return (EPROTOTYPE);
 		mtx_lock(&tp->tun_mtx);
 		TUN2IFP(tp)->if_mtu = tunp->mtu;
-		TUN2IFP(tp)->if_type = tunp->type;
 		TUN2IFP(tp)->if_baudrate = tunp->baudrate;
 		mtx_unlock(&tp->tun_mtx);
 		break;
-- 
2.42.0