| Message ID | 20191010164800.2444-1-ingo.rohloff@lauterbach.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | usb: usbfs: Suppress problematic bind and unbind uevents. | expand |
On Thu, Oct 10, 2019 at 06:48:00PM +0200, Ingo Rohloff wrote: > commit 1455cf8dbfd0 ("driver core: emit uevents when device is bound > to a driver") added bind and unbind uevents when a driver is bound or > unbound to a physical device. > > For USB devices which are handled via the generic usbfs layer (via > libusb for example), this is problematic: > Each time a user space program calls > ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); > and then later > ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); > The kernel will now produce a bind or unbind event, which does not > really contain any useful information. > > This allows a user space program to run a DoS attack against programs > which listen to uevents (in particular systemd/eudev/upowerd): > A malicious user space program just has to call in a tight loop > > ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); > ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); > > With this loop the malicious user space program floods the kernel and > all programs listening to uevents with tons of bind and unbind > events. > > This patch suppresses uevents for ioctls USBDEVFS_CLAIMINTERFACE and > USBDEVFS_RELEASEINTERFACE. > > Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com> > --- > drivers/usb/core/devio.c | 15 ++++++++++++++- > 1 file changed, 14 insertions(+), 1 deletion(-) I am guessing this is a new version of a previously-submitted patch? If so, you need to include a "version" number on it, and put what you changed below the --- line. The kernel documentation should explain how to do this, if not, please let us know. Please fix this up and resend. thanks, greg k-h
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 3f899552f6e3..6ca40d135430 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -764,8 +764,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) intf = usb_ifnum_to_if(dev, ifnum); if (!intf) err = -ENOENT; - else + else { + unsigned int old_suppress; + + /* suppress uevents while claiming interface */ + old_suppress = dev_get_uevent_suppress(&intf->dev); + dev_set_uevent_suppress(&intf->dev, 1); err = usb_driver_claim_interface(&usbfs_driver, intf, ps); + dev_set_uevent_suppress(&intf->dev, old_suppress); + } if (err == 0) set_bit(ifnum, &ps->ifclaimed); return err; @@ -785,7 +792,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) if (!intf) err = -ENOENT; else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { + unsigned int old_suppress; + + /* suppress uevents while releasing interface */ + old_suppress = dev_get_uevent_suppress(&intf->dev); + dev_set_uevent_suppress(&intf->dev, 1); usb_driver_release_interface(&usbfs_driver, intf); + dev_set_uevent_suppress(&intf->dev, old_suppress); err = 0; } return err;
commit 1455cf8dbfd0 ("driver core: emit uevents when device is bound to a driver") added bind and unbind uevents when a driver is bound or unbound to a physical device. For USB devices which are handled via the generic usbfs layer (via libusb for example), this is problematic: Each time a user space program calls ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); and then later ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); The kernel will now produce a bind or unbind event, which does not really contain any useful information. This allows a user space program to run a DoS attack against programs which listen to uevents (in particular systemd/eudev/upowerd): A malicious user space program just has to call in a tight loop ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr); ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr); With this loop the malicious user space program floods the kernel and all programs listening to uevents with tons of bind and unbind events. This patch suppresses uevents for ioctls USBDEVFS_CLAIMINTERFACE and USBDEVFS_RELEASEINTERFACE. Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com> --- drivers/usb/core/devio.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)