- Add suser check before SIOCSAIRONET.

- Fix a splimp() w/o splx bug in the ioctl routine while I'm here.

Submitted by:	Aaron Campbell <aaron@openbsd.org>

1 files changed, 10 insertions, 3 deletions

diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c
index 34a5263..8abf07b 100644
--- a/sys/dev/an/if_an.c
+++ b/sys/dev/an/if_an.c
@@ -95,6 +95,8 @@
 #include <sys/sockio.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
+#include <sys/proc.h>
+#include <sys/ucred.h>
 #include <sys/socket.h>
 #ifdef ANCACHE
 #include <sys/syslog.h>
@@ -968,14 +970,17 @@ static int an_ioctl(ifp, command, data)
 	struct an_softc		*sc;
 	struct an_req		areq;
 	struct ifreq		*ifr;
+	struct proc		*p = curproc;
 
 	s = splimp();
 
 	sc = ifp->if_softc;
 	ifr = (struct ifreq *)data;
 
-	if (sc->an_gone)
-		return(ENODEV);
+	if(sc->an_gone) {
+		error = ENODEV;
+		goto out;
+	}
 
 	switch(command) {
 	case SIOCSIFADDR:
@@ -1034,6 +1039,8 @@ static int an_ioctl(ifp, command, data)
 		error = copyout(&areq, ifr->ifr_data, sizeof(areq));
 		break;
 	case SIOCSAIRONET:
+                if ((error = suser(p)))
+                        goto out;
 		error = copyin(ifr->ifr_data, &areq, sizeof(areq));
 		if (error)
 			break;
@@ -1043,7 +1050,7 @@ static int an_ioctl(ifp, command, data)
 		error = EINVAL;
 		break;
 	}
-
+out:
 	splx(s);
 
 	return(error);