cxgb3: Use CAP_SYS_RAWIO for firmware
authorAlan Cox <alan@lxorguk.ukuu.org.uk>
Tue, 29 Apr 2008 13:29:30 +0000 (14:29 +0100)
committerJeff Garzik <jgarzik@redhat.com>
Tue, 6 May 2008 16:27:53 +0000 (12:27 -0400)
Otherwise theoretically at least

CAP_NET_ADMIN
Reload new firmware
Wait..
Firmware patches kernel

So it should be CAY_SYS_RAWIO - not that I suspect this is in fact a
credible attack vector!

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
drivers/net/cxgb3/cxgb3_main.c

index 05e5f59..ce949d5 100644 (file)
@@ -1894,11 +1894,11 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
                u8 *fw_data;
                struct ch_mem_range t;
 
-               if (!capable(CAP_NET_ADMIN))
+               if (!capable(CAP_SYS_RAWIO))
                        return -EPERM;
                if (copy_from_user(&t, useraddr, sizeof(t)))
                        return -EFAULT;
-
+               /* Check t.len sanity ? */
                fw_data = kmalloc(t.len, GFP_KERNEL);
                if (!fw_data)
                        return -ENOMEM;