DivestOS/Patches/Linux_CVEs/CVE-2016-0806/prima/0004.patch
2017-11-07 18:55:10 -05:00

43 lines
1.5 KiB
Diff

From fbb8f120ee729d47869f0bebe5bc31e83bcf2876 Mon Sep 17 00:00:00 2001
From: Mukul Sharma <mukul@qti.qualcomm.com>
Date: Thu, 17 Mar 2016 10:28:36 -0700
Subject: wlan:Check priviledge permission
for SET_VAR_INTS_GETNONE IOCTL
Kernel assumes all SET IOCTL commands are assigned with even
numbers. But in our WLAN driver, some SET IOCTLS are assigned with
odd numbers. This leads kernel fail to check, for some SET IOCTLs,
whether user has the right permission to do SET operation.
Hence, in driver, before processing SET_VAR_INTS_GETNONE, making
sure user task has right permission to process the command.
Bug: 27104184
Change-Id: Ia2465433aab6366160a167a62ca03e0ba720bcdb
Signed-off-by: Yuan Lin <yualin@google.com>
---
drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c
index 6a806f4..9b41a5e 100644
--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c
+++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c
@@ -4508,6 +4508,13 @@ int iw_set_var_ints_getnone(struct net_device *dev, struct iw_request_info *info
int cmd = 0;
int staId = 0;
+ if (!capable(CAP_NET_ADMIN))
+ {
+ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+ FL("permission check failed"));
+ return -EPERM;
+ }
+
hddLog(LOG1, "%s: Received length %d", __func__, wrqu->data.length);
if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress)
--
cgit v1.1