When DebugFS is activated in the kernel, some distro auto-mount it in /sys/kernel/debug and permissions to reset the card, set debug and other stuff are wide open to any users, reset being set 0222 allows anyone to reset the card anytime (and on my computer it crashes the whole thing.) I would suggest removing any write access to users for all the files created un ath5k/debug.c and even read permissions to user and group to be more secure.
I've made a patch to fix it, it's very simple to fix it: http://marc.info/?l=linux-kernel&m=122732420108666&w=2 but I dont' have that hardware, please test it if you have it.
I had a similar patch I forgot to attach I submitted to the ath5k tracker but this one is even better because it uses S_I* constants, here is the result of the test; Before: p4 sys # ls /sys/kernel/debug/ath5k/phy0/ -l total 0 -rw-rw-rw- 1 root root 0 2008-11-23 10:41 beacon -rw-rw-rw- 1 root root 0 2008-11-23 10:41 debug -r--r--r-- 1 root root 0 2008-11-23 10:41 registers --w--w--w- 1 root root 0 2008-11-23 10:41 reset -rw-rw-rw- 1 root root 0 2008-11-23 10:41 tsf Patch... p4 sys # cd /usr/src/linux p4 linux # patch -p1 -i ../linux-2.6.27-gentoo-r1/perm.patch patching file drivers/net/wireless/ath5k/debug.c p4 linux # make modules ... p4 linux # rmmod ath5k p4 linux # insmod drivers/net/wireless/ath5k/ath5k.ko After: p4 linux # ls /sys/kernel/debug/ath5k/phy1/ -l total 0 -rw-r--r-- 1 root root 0 2008-11-23 11:39 beacon -rw-r--r-- 1 root root 0 2008-11-23 11:39 debug -r--r--r-- 1 root root 0 2008-11-23 11:39 registers --w------- 1 root root 0 2008-11-23 11:39 reset -rw-r--r-- 1 root root 0 2008-11-23 11:39 tsf Seems perfect! Thanks.
This is fixed by: commit 66bc446d4fd057310cc6310721c33767e7c0b408 Author: Cheng Renquan <crquan@gmail.com> Date: Sat Nov 22 11:22:49 2008 +0800 ath5k: fix Security issue in DebugFS part of ath5k http://bugzilla.kernel.org/show_bug.cgi?id=12076 Remove any write access to groups and others, only keep write permission to its owner, usually only root user. Reported-by: Jérôme Poulin <jeromepoulin@gmail.com> Signed-off-by: Cheng Renquan <crquan@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
It just need to be propagated to the other kernels.