From 2628a3eeecdf7ff471eb9cbb186b05e72b47398d Mon Sep 17 00:00:00 2001
From: roberto <roberto@FreeBSD.org>
Date: Sun, 18 Jun 2000 23:40:09 +0000
Subject: - Add suser check before SIOCSAIRONET. - Fix a splimp() w/o splx bug
 in the ioctl routine while I'm here.

Submitted by:	Aaron Campbell <aaron@openbsd.org>
---
 sys/dev/an/if_an.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'sys/dev/an')

diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c
index 34a5263..8abf07b 100644
--- a/sys/dev/an/if_an.c
+++ b/sys/dev/an/if_an.c
@@ -95,6 +95,8 @@
 #include <sys/sockio.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
+#include <sys/proc.h>
+#include <sys/ucred.h>
 #include <sys/socket.h>
 #ifdef ANCACHE
 #include <sys/syslog.h>
@@ -968,14 +970,17 @@ static int an_ioctl(ifp, command, data)
 	struct an_softc		*sc;
 	struct an_req		areq;
 	struct ifreq		*ifr;
+	struct proc		*p = curproc;
 
 	s = splimp();
 
 	sc = ifp->if_softc;
 	ifr = (struct ifreq *)data;
 
-	if (sc->an_gone)
-		return(ENODEV);
+	if(sc->an_gone) {
+		error = ENODEV;
+		goto out;
+	}
 
 	switch(command) {
 	case SIOCSIFADDR:
@@ -1034,6 +1039,8 @@ static int an_ioctl(ifp, command, data)
 		error = copyout(&areq, ifr->ifr_data, sizeof(areq));
 		break;
 	case SIOCSAIRONET:
+                if ((error = suser(p)))
+                        goto out;
 		error = copyin(ifr->ifr_data, &areq, sizeof(areq));
 		if (error)
 			break;
@@ -1043,7 +1050,7 @@ static int an_ioctl(ifp, command, data)
 		error = EINVAL;
 		break;
 	}
-
+out:
 	splx(s);
 
 	return(error);
-- 
cgit v1.1