From: Jann Horn Date: Wed, 16 Oct 2024 15:24:06 +0000 (+0200) Subject: usb: require FMODE_WRITE for usbdev_mmap() X-Git-Tag: v6.13-rc1~31^2~106 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3ea36dc8ddd72d92d737612507f98dfaf3b77c3f;p=thirdparty%2Fkernel%2Flinux.git usb: require FMODE_WRITE for usbdev_mmap() usbdev_mmap() creates VMAs which can only be used through usbdev_do_ioctl(), which requires FMODE_WRITE; so usbdev_mmap() is only useful with FMODE_WRITE. On typical Linux systems, files at /dev/bus/usb/*/* are mode 0664, so UIDs without any special privileges can't use usbdev_do_ioctl(), but they can still execute the usbdev_mmap() codepath. Check for FMODE_WRITE in usbdev_mmap() to reduce attack surface a little bit. Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20241016-usbdev-mmap-require-write-v1-1-6f8256414d5c@google.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 3beb6a862e808..5363468a282f8 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -238,6 +238,9 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) dma_addr_t dma_handle = DMA_MAPPING_ERROR; int ret; + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory)); if (ret) goto error;