From ef2ddd6756d0549021b99e75f02645caa145d79f Mon Sep 17 00:00:00 2001
From: Jerry Lee <jerrylee@broadcom.com>
Date: Wed, 23 Mar 2016 14:33:50 -0700
Subject: [PATCH] net: wireless: bcmdhd: check privilege on priv cmd

(cherry pick from commit 7b4bd6e41ed514dddf9e403472b1fb6f808d3f4b)

check net admin capability for ioctl calls

Signed-off-by: Jerry Lee <jerrylee@broadcom.com>
Bug: 26425765
Bug: 27997075
Change-Id: Iae1b53aa62fdc24530bb1b85cb69740c87d182e9
CVE-2016-2475
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
---
 drivers/net/wireless/bcmdhd/wl_android.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/bcmdhd/wl_android.c b/drivers/net/wireless/bcmdhd/wl_android.c
index c54fd164660..e0978d6f6c8 100644
--- a/drivers/net/wireless/bcmdhd/wl_android.c
+++ b/drivers/net/wireless/bcmdhd/wl_android.c
@@ -3574,6 +3574,11 @@ int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
 		goto exit;
 	}
 
+	if (!capable(CAP_NET_ADMIN)) {
+		ret = -EPERM;
+		goto exit;
+	}
+
 #ifdef CONFIG_COMPAT
 	if (is_compat_task()) {
 		compat_android_wifi_priv_cmd compat_priv_cmd;