From a0b74543ffb1fe04e7d5dde66bd82cf3d0c7beff Mon Sep 17 00:00:00 2001
From: Ollivier Robert <roberto@FreeBSD.org>
Date: Mon, 19 Jun 2000 00:17:13 +0000
Subject: Bring the an(4) fixes to wi(4): - suser check - splx() fix.

Reminded by:	Aaron Campbell <aaron@openbsd.org>
---
 sys/dev/wi/if_wi.c   | 13 ++++++++++---
 sys/i386/isa/if_wi.c | 13 ++++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)

(limited to 'sys')

diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c
index 441beafa3c5e..deb797cea676 100644
--- a/sys/dev/wi/if_wi.c
+++ b/sys/dev/wi/if_wi.c
@@ -73,6 +73,8 @@
 #include <sys/sockio.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
+#include <sys/proc.h>
+#include <sys/ucred.h>
 #include <sys/socket.h>
 #include <sys/module.h>
 #include <sys/bus.h>
@@ -962,14 +964,17 @@ static int wi_ioctl(ifp, command, data)
 	struct wi_softc		*sc;
 	struct wi_req		wreq;
 	struct ifreq		*ifr;
+	struct proc		*p = curproc;
 
 	s = splimp();
 
 	sc = ifp->if_softc;
 	ifr = (struct ifreq *)data;
 
-	if (sc->wi_gone)
-		return(ENODEV);
+	if (sc->wi_gone) {
+		error = ENODEV;
+		goto out;
+	}
 
 	switch(command) {
 	case SIOCSIFADDR:
@@ -1038,6 +1043,8 @@ static int wi_ioctl(ifp, command, data)
 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
 		break;
 	case SIOCSWAVELAN:
+		if ((error = suser(p)))
+			goto out;
 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
 		if (error)
 			break;
@@ -1057,7 +1064,7 @@ static int wi_ioctl(ifp, command, data)
 		error = EINVAL;
 		break;
 	}
-
+out:
 	splx(s);
 
 	return(error);
diff --git a/sys/i386/isa/if_wi.c b/sys/i386/isa/if_wi.c
index 441beafa3c5e..deb797cea676 100644
--- a/sys/i386/isa/if_wi.c
+++ b/sys/i386/isa/if_wi.c
@@ -73,6 +73,8 @@
 #include <sys/sockio.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
+#include <sys/proc.h>
+#include <sys/ucred.h>
 #include <sys/socket.h>
 #include <sys/module.h>
 #include <sys/bus.h>
@@ -962,14 +964,17 @@ static int wi_ioctl(ifp, command, data)
 	struct wi_softc		*sc;
 	struct wi_req		wreq;
 	struct ifreq		*ifr;
+	struct proc		*p = curproc;
 
 	s = splimp();
 
 	sc = ifp->if_softc;
 	ifr = (struct ifreq *)data;
 
-	if (sc->wi_gone)
-		return(ENODEV);
+	if (sc->wi_gone) {
+		error = ENODEV;
+		goto out;
+	}
 
 	switch(command) {
 	case SIOCSIFADDR:
@@ -1038,6 +1043,8 @@ static int wi_ioctl(ifp, command, data)
 		error = copyout(&wreq, ifr->ifr_data, sizeof(wreq));
 		break;
 	case SIOCSWAVELAN:
+		if ((error = suser(p)))
+			goto out;
 		error = copyin(ifr->ifr_data, &wreq, sizeof(wreq));
 		if (error)
 			break;
@@ -1057,7 +1064,7 @@ static int wi_ioctl(ifp, command, data)
 		error = EINVAL;
 		break;
 	}
-
+out:
 	splx(s);
 
 	return(error);
-- 
cgit v1.3