tests: Test for an epair panic

if_epair abused the ifr_data field to insert its second interface in
IFC_IFLIST. If userspace provides a value for ifr_data it would get
dereferenced by the kernel leading to a panic.

Reported by:	Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after:	3 days

2 files changed, 75 insertions, 1 deletions

diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile
index 8bbd6612067d..c85167c6045f 100644
--- a/tests/sys/net/Makefile
+++ b/tests/sys/net/Makefile
@@ -9,6 +9,7 @@ ATF_TESTS_SH+=	if_lagg_test
 ATF_TESTS_SH+=	if_clone_test
 ATF_TESTS_SH+=	if_tun_test
 ATF_TESTS_SH+=	if_vlan
+ATF_TESTS_C+=	if_epair
 
 TESTS_SUBDIRS+=	routing
 
@@ -18,7 +19,7 @@ TESTS_SUBDIRS+=	routing
 TEST_METADATA+=	is_exclusive=true
 
 MAN=
-PROG=		randsleep
+PROGS+=		randsleep
 
 WARNS?=		6
 
diff --git a/tests/sys/net/if_epair.c b/tests/sys/net/if_epair.c
new file mode 100644
index 000000000000..a90eb8d37072
--- /dev/null
+++ b/tests/sys/net/if_epair.c
@@ -0,0 +1,73 @@
+/*-
+ * Copyright (c) 2020   Kristof Provost <kp@FreeBSD.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/ioctl.h>
+#include <sys/linker.h>
+#include <sys/module.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#include <net/if.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+
+#include <atf-c.h>
+
+ATF_TC(params);
+ATF_TC_HEAD(params, tc)
+{
+        atf_tc_set_md_var(tc, "require.user", "root");
+}
+
+ATF_TC_BODY(params, tc)
+{
+	struct ifreq ifr;
+	int s;
+
+	s = kldload("if_epair");
+	if (s != 0)
+		atf_tc_fail("Failed to load if_epair");
+
+	s = socket(AF_INET, SOCK_DGRAM, 0);
+	if (s < 0)
+		atf_tc_fail("Failed to create socket");
+
+        bzero(&ifr, sizeof(ifr));
+	ifr.ifr_data = (caddr_t)-1;
+        (void) strlcpy(ifr.ifr_name, "epair", sizeof(ifr.ifr_name));
+
+	ioctl(s, SIOCIFCREATE2, &ifr);
+}
+
+ATF_TP_ADD_TCS(tp)
+{
+        ATF_TP_ADD_TC(tp, params);
+
+	return (atf_no_error());
+}