commit bebb8a5e2cd30adcc5e9a14c3366a231da728aee
author Johannes Berg <johannes@sipsolutions.net> Fri Apr 04 23:33:37 2008 +0200
committer John W. Linville <linville@tuxdriver.com> Tue Apr 08 16:44:43 2008 -0400
tree d4965ea266e0415ecea063aa7e54fd41aaa311fe
parent a82d992261f79506a0d55b9a179a211f96caf878

mac80211: make debugfs files root-only

Unfortunately, debugfs can be made to access invalid memory by
open()ing a file and then waiting until the corresponding debugfs
file has been removed (and, probably, the underlying object.)

That could be exploited by any user if the user is able to open
debugfs files and can cause networking devices, STA entries or
similar to disappear which is quite easy to do.

Hence, all debugfs files should be root-only.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

net/mac80211/debugfs.c

diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 4736c64..f4bb08b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -37,7 +37,7 @@
 };
 
 #define DEBUGFS_ADD(name)						\
-	local->debugfs.name = debugfs_create_file(#name, 0444, phyd,	\
+	local->debugfs.name = debugfs_create_file(#name, 0400, phyd,	\
 						  local, &name## _ops);
 
 #define DEBUGFS_DEL(name)						\
@@ -130,7 +130,7 @@
 };
 
 #define DEBUGFS_STATS_ADD(name)						\
-	local->debugfs.stats.name = debugfs_create_file(#name, 0444, statsd,\
+	local->debugfs.stats.name = debugfs_create_file(#name, 0400, statsd,\
 		local, &stats_ ##name## _ops);
 
 #define DEBUGFS_STATS_DEL(name)						\

net/mac80211/debugfs_netdev.c

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 3e19d42..55cd6fc 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -243,7 +243,7 @@
 
 
 #define DEBUGFS_ADD(name, type)\
-	sdata->debugfs.type.name = debugfs_create_file(#name, 0444,\
+	sdata->debugfs.type.name = debugfs_create_file(#name, 0400,\
 		sdata->debugfsdir, sdata, &name##_ops);
 
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
@@ -298,7 +298,7 @@
 
 #ifdef CONFIG_MAC80211_MESH
 #define MESHSTATS_ADD(name)\
-	sdata->mesh_stats.name = debugfs_create_file(#name, 0444,\
+	sdata->mesh_stats.name = debugfs_create_file(#name, 0400,\
 		sdata->mesh_stats_dir, sdata, &name##_ops);
 
 static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
@@ -312,7 +312,7 @@
 }
 
 #define MESHPARAMS_ADD(name)\
-	sdata->mesh_config.name = debugfs_create_file(#name, 0644,\
+	sdata->mesh_config.name = debugfs_create_file(#name, 0600,\
 		sdata->mesh_config_dir, sdata, &name##_ops);
 
 static void add_mesh_config(struct ieee80211_sub_if_data *sdata)

net/mac80211/debugfs_sta.c

diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 256ea88..6d47a1d 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -266,7 +266,7 @@
 STA_OPS_WR(agg_status);
 
 #define DEBUGFS_ADD(name) \
-	sta->debugfs.name = debugfs_create_file(#name, 0444, \
+	sta->debugfs.name = debugfs_create_file(#name, 0400, \
 		sta->debugfs.dir, sta, &sta_ ##name## _ops);
 
 #define DEBUGFS_DEL(name) \