DivestOS/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0012.patch
2017-11-07 18:55:10 -05:00

45 lines
1.7 KiB
Diff

From 55bdc6d1c88a100dc4a71bf855b69db522c9b5b5 Mon Sep 17 00:00:00 2001
From: Jeff Johnson <jjohnson@qca.qualcomm.com>
Date: Tue, 27 Oct 2015 13:29:21 -0700
Subject: qcacld-2.0: Add privilege check for QCSAP_IOCTL_WOWL_CONFIG_PTRN
By convention Wireless Extension SET ioctls are supposed to be
assigned even ioctl numbers. But in our WLAN driver some SET ioctls
were assigned odd numbers. This means the kernel will fail to check,
for those particular SET ioctls, whether or not the user has the right
permission to do SET operations. QCSAP_IOCTL_WOWL_CONFIG_PTRN is one
such ioctl.
Ideally we would renumber this ioctl to conform to the Wireless
Extensions convention. Unfortunately we don't know what userspace
applications have this ioctl number hard-coded. Hence, in the driver,
before processing the QCSAP_IOCTL_WOWL_CONFIG_PTRN ioctl, make sure
the user task has the right permission to execute the command.
Change-Id: Id61c1ec8dbbe4bbec2b032e12ffcc6139bb78b14
CRs-Fixed: 931127
---
CORE/HDD/src/wlan_hdd_hostapd.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 9a96d5e..270f5e1 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -2525,6 +2525,12 @@ static __iw_softap_wowl_config_pattern(struct net_device *dev,
hdd_adapter_t *pAdapter = (netdev_priv(dev));
struct iw_point s_priv_data;
+ if (!capable(CAP_NET_ADMIN)) {
+ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+ FL("permission check failed"));
+ return -EPERM;
+ }
+
if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress)
{
VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL,
--
cgit v1.1