commit 1b3aa7afb60d34867eea5e73ee943b2a026fc47c
author Alan Cox <alan@lxorguk.ukuu.org.uk> Tue Apr 29 14:29:30 2008 +0100
committer Jeff Garzik <jgarzik@redhat.com> Tue May 06 12:27:53 2008 -0400
tree b3be54db2b92251ba06c3d5155750f4ce0c593c8
parent 01935d7d2c544a5dfc8313f79ed164d45115aa33

cxgb3: Use CAP_SYS_RAWIO for firmware

Otherwise theoretically at least

	CAP_NET_ADMIN
	Reload new firmware
	Wait..
	Firmware patches kernel

So it should be CAY_SYS_RAWIO - not that I suspect this is in fact a
credible attack vector!

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

drivers/net/cxgb3/cxgb3_main.c

diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 05e5f59e..ce949d5 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1894,11 +1894,11 @@
 		u8 *fw_data;
 		struct ch_mem_range t;
 
-		if (!capable(CAP_NET_ADMIN))
+		if (!capable(CAP_SYS_RAWIO))
 			return -EPERM;
 		if (copy_from_user(&t, useraddr, sizeof(t)))
 			return -EFAULT;
-
+		/* Check t.len sanity ? */
 		fw_data = kmalloc(t.len, GFP_KERNEL);
 		if (!fw_data)
 			return -ENOMEM;