2 files changed, 12 insertions, 1 deletions

diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index 2784f91896db..160cb27e120c 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -742,9 +742,17 @@ static void release_descriptor(struct client *client,
 static int ioctl_add_descriptor(struct client *client, void *buffer)
 {
         struct fw_cdev_add_descriptor *request = buffer;
+        struct fw_card *card = client->device->card;
         struct descriptor_resource *r;
         int ret;
 
+        /* Access policy: Allow this ioctl only on local nodes' device files. */
+        spin_lock_irq(&card->lock);
+        ret = client->device->node_id != card->local_node->node_id;
+        spin_unlock_irq(&card->lock);
+        if (ret)
+                return -ENOSYS;
+
         if (request->length > 256)
                 return -EINVAL;
 
diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
index de4035792f70..25bc82726ef7 100644
--- a/include/linux/firewire-cdev.h
+++ b/include/linux/firewire-cdev.h
@@ -394,6 +394,9 @@ struct fw_cdev_initiate_bus_reset {
  * If successful, the kernel adds the descriptor and writes back a handle to the
  * kernel-side object to be used for later removal of the descriptor block and
  * immediate key.
+ *
+ * This ioctl affects the configuration ROMs of all local nodes.
+ * The ioctl only succeeds on device files which represent a local node.
  */
 struct fw_cdev_add_descriptor {
         __u32 immediate;
@@ -409,7 +412,7 @@ struct fw_cdev_add_descriptor {
  *              descriptor was added
  *
  * Remove a descriptor block and accompanying immediate key from the local
- * node's configuration ROM.
+ * nodes' configuration ROMs.
  */
 struct fw_cdev_remove_descriptor {
         __u32 handle;