brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux-brain/drivers/hid
History
Eric Biggers 645cb3965b HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges 
commit 8c01db7619 upstream.

When a UHID_CREATE command is written to the uhid char device, a
copy_from_user() is done from a user pointer embedded in the command.
When the address limit is KERNEL_DS, e.g. as is the case during
sys_sendfile(), this can read from kernel memory.  Alternatively,
information can be leaked from a setuid binary that is tricked to write
to the file descriptor.  Therefore, forbid UHID_CREATE in these cases.

No other commands in uhid_char_write() are affected by this bug and
UHID_CREATE is marked as "obsolete", so apply the restriction to
UHID_CREATE only rather than to uhid_char_write() entirely.

Thanks to Dmitry Vyukov for adding uhid definitions to syzkaller and to
Jann Horn for commit 9da3f2b740 ("x86/fault: BUG() when uaccess
helpers fault on kernel addresses"), allowing this bug to be found.

Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
Fixes: d365c6cfd3 ("HID: uhid: add UHID_CREATE and UHID_DESTROY events")
Cc: <stable@vger.kernel.org> # v3.6+
Cc: Jann Horn <jannh@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2018-11-27 16:08:02 +01:00
..
i2c-hid HID: i2c-hid: check if device is there before really probing 2018-08-06 16:24:36 +02:00
usbhid HID: hiddev: fix potential Spectre v1 2018-11-21 09:27:34 +01:00
Kconfig HID: chicony: Add support for another ASUS Zen AiO keyboard 2017-12-16 10:33:52 +01:00
Makefile Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2015-11-07 12:49:27 -08:00
hid-a4tech.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hid-apple.c HID: apple: Add support for the 2015 Macbook Pro 2015-07-27 15:43:46 -07:00
hid-appleir.c HID: hid-input: allow input_configured callback return errors 2015-11-05 09:51:50 -08:00
hid-aureal.c HID: fix some indenting issues 2015-10-21 13:15:53 +02:00
hid-axff.c HID: enable Mayflash USB Gamecube Adapter 2013-11-12 19:06:23 +01:00
hid-belkin.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-betopff.c HID: betop: add drivers/hid/hid-betopff.c 2014-12-22 15:00:25 +01:00
hid-cherry.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-chicony.c HID: chicony: Add support for another ASUS Zen AiO keyboard 2017-12-16 10:33:52 +01:00
hid-core.c HID: sony: Support DS4 dongle 2018-09-29 03:08:54 -07:00
hid-corsair.c HID: corsair: fix control-transfer error handling 2017-01-26 08:23:48 +01:00
hid-cp2112.c HID: cp2112: fix byte order in SMBUS operations 2015-07-14 22:42:42 +02:00
hid-cypress.c HID: hid-cypress: validate length of report 2017-01-15 13:41:36 +01:00
hid-debug.c HID: debug: check length before copy_to_user() 2018-07-11 16:03:50 +02:00
hid-dr.c HID: dragonrise: fix HID Descriptor for 0x0006 PID 2015-09-04 14:52:09 +02:00
hid-elecom.c HID: fix some indenting issues 2015-10-21 13:15:53 +02:00
hid-elo.c HID: elo: clear BTN_LEFT mapping 2018-03-22 09:23:27 +01:00
hid-emsff.c HID: use hid_hw_request() instead of direct call to usbhid 2013-02-25 13:26:41 +01:00
hid-ezkey.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-gaff.c HID: use hid_hw_request() instead of direct call to usbhid 2013-02-25 13:26:41 +01:00
hid-gembird.c HID: gembird: add new driver to fix Gembird JPD-DualForce 2 2015-08-18 15:03:43 +02:00
hid-generic.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-gfrm.c HID: hid-gfrm: avoid warning for input_configured API change 2015-11-05 10:15:35 -08:00
hid-gt683r.c HID: gt683r: move mode attribute to led-class devices 2014-07-03 11:14:11 -07:00
hid-gyration.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-holtek-kbd.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-holtek-mouse.c HID: Add Holtek USB ID 04d9:a0c2 ETEKCITY Scroll 2014-09-08 09:48:56 +02:00
hid-holtekff.c HID: hid-holtekff: don't push static constants on stack for %*ph 2013-08-05 11:29:57 +02:00
hid-hyperv.c HID: hyperv: match wait_for_completion_timeout return type 2015-01-26 14:25:41 +01:00
hid-icade.c HID: icade: u16 which never < 0 2013-04-24 16:32:27 +02:00
hid-ids.h HID: sony: Support DS4 dongle 2018-09-29 03:08:54 -07:00
hid-input.c HID: Fix hid_report_len usage 2018-04-24 09:32:07 +02:00
hid-kensington.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-keytouch.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-kye.c HID: kye: Fix report descriptor for Genius PenSketch M912 2015-02-17 13:13:45 +01:00
hid-lcpower.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-lenovo.c HID: hid-input: allow input_configured callback return errors 2015-11-05 09:51:50 -08:00
hid-lg.c HID: lg: restrict filtering out of first interface to G29 only 2015-12-02 14:51:00 +01:00
hid-lg.h HID: hid-lg4ff: Introduce a module parameter to disable automatic switch of compatibility mode 2015-02-18 21:14:54 +01:00
hid-lg2ff.c HID: logitech - lg2ff: Add IDs for Formula Vibration Feedback Wheel 2013-10-09 12:06:02 +02:00
hid-lg3ff.c HID: LG: validate HID output report details 2013-09-13 15:12:39 +02:00
hid-lg4ff.c HID: logitech: Add support for G29 2015-11-06 21:18:06 +01:00
hid-lg4ff.h HID: hid-lg4ff: Remove double underscore prefix from numeric types 2015-05-07 16:27:07 +02:00
hid-lgff.c HID: LG: validate HID output report details 2013-09-13 15:12:39 +02:00
hid-logitech-dj.c HID: logitech-dj: check report length 2014-12-17 08:50:12 +01:00
hid-logitech-hidpp.c Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus 2015-11-06 21:45:15 +01:00
hid-magicmouse.c HID: hid-input: allow input_configured callback return errors 2015-11-05 09:51:50 -08:00
hid-microsoft.c HID: Add new Microsoft Type Cover 3 product ID 2015-09-23 11:47:24 +02:00
hid-monterey.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-multitouch.c HID: Fix hid_report_len usage 2018-04-24 09:32:07 +02:00
hid-ntrig.c HID: hid-ntrig: add error handling for sysfs_create_group 2018-10-10 08:52:06 +02:00
hid-ortek.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-penmount.c HID: add support for PenMount HID TouchScreen Driver 2014-09-04 11:23:51 +02:00
hid-petalynx.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-picolcd.h Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and 'for-3.10/upstream' into for-linus 2013-04-30 10:19:07 +02:00
hid-picolcd_backlight.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_cir.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_core.c HID: picolcd: be more verbose when reporting report size error 2014-08-27 23:27:10 +02:00
hid-picolcd_debugfs.c HID: picolcd: remove unnecessary NULL test before debugfs_remove 2014-06-30 09:54:22 +02:00
hid-picolcd_fb.c drivers/hid/hid-picolcd_fb: avoid world-writable sysfs files. 2014-05-14 10:53:56 +09:30
hid-picolcd_lcd.c HID: picoLCD: Deletion of unnecessary checks before three function calls 2015-06-29 14:51:12 +02:00
hid-picolcd_leds.c HID: use hid_hw_request() instead of direct call to usbhid 2013-02-25 13:26:41 +01:00
hid-pl.c HID: pantherlord: validate output report details 2013-09-04 11:58:32 +02:00
hid-plantronics.c HID: hid-plantronics: Re-resend Update to map button for PTT products 2018-08-06 16:24:35 +02:00
hid-primax.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-prodikeys.c HID: fix some indenting issues 2015-10-21 13:15:53 +02:00
hid-rmi.c HID: Fix hid_report_len usage 2018-04-24 09:32:07 +02:00
hid-roccat-arvo.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-arvo.h
…
hid-roccat-common.c HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-common.h HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-isku.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2013-09-06 09:30:36 -07:00
hid-roccat-isku.h HID: roccat: add support for IskuFX 2013-03-14 11:50:49 +01:00
hid-roccat-kone.c HID: roccat: Fix code style issues 2014-10-29 14:56:30 +01:00
hid-roccat-kone.h HID: roccat: added media key support for Kone 2013-04-08 10:33:13 +02:00
hid-roccat-koneplus.c HID: roccat: Fix "cannot create duplicate filename" problems 2013-09-30 10:51:31 +02:00
hid-roccat-koneplus.h HID: roccat: fix wrong attr size for koneplus tcu 2012-11-18 22:58:28 +01:00
hid-roccat-konepure.c HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-kovaplus.c HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() 2018-05-30 07:48:54 +02:00
hid-roccat-kovaplus.h HID: roccat: deprecate some Kovaplus attributes 2012-11-12 15:30:29 +01:00
hid-roccat-lua.c HID: roccat: Drop cast 2014-06-27 00:33:44 +02:00
hid-roccat-lua.h HID: roccat: add support for Roccat Lua 2012-10-17 10:44:47 +02:00
hid-roccat-pyra.c HID: roccat: potential out of bounds in pyra_sysfs_write_settings() 2015-01-09 14:41:01 +01:00
hid-roccat-pyra.h HID: roccat: deprecated some Pyra attributes 2012-11-12 15:30:28 +01:00
hid-roccat-ryos.c HID: roccat: add support for Ryos MK keyboards 2013-10-30 14:17:31 +01:00
hid-roccat-savu.c HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat-savu.h HID: roccat: generalize some common code 2013-10-30 14:17:31 +01:00
hid-roccat.c HID: roccat: check cdev_add return value 2013-06-18 11:00:36 +02:00
hid-saitek.c HID: saitek: mode button quirk for Mad Catz R.A.T.5 2015-09-04 14:44:44 +02:00
hid-samsung.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-sensor-custom.c HID: sensor: Custom and Generic sensor support 2015-04-10 22:22:55 +02:00
hid-sensor-hub.c Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus 2015-11-06 21:45:15 +01:00
hid-sjoy.c HID: sjoy: support Super Joy Box 4 2015-05-07 10:47:53 +02:00
hid-sony.c HID: sony: Support DS4 dongle 2018-09-29 03:08:54 -07:00
hid-speedlink.c HID: Fix Speedlink VAD Cezanne support for some devices 2013-08-26 13:51:10 +02:00
hid-steelseries.c HID: remove 2 unused usb.h includes 2015-02-27 00:36:23 +01:00
hid-sunplus.c HID: fix a couple of off-by-ones 2014-08-21 10:43:28 -05:00
hid-thingm.c Merge branches 'for-3.18/always-poll-quirk', 'for-3.18/logitech', 'for-3.18/picolcd', 'for-3.18/rmi', 'for-3.18/sony', 'for-3.18/uhid', 'for-3.18/upstream' and 'for-3.18/wacom' into for-linus 2014-10-06 23:34:40 +02:00
hid-tivo.c HID: tivo: enable all buttons on the TiVo Slide Pro remote 2015-03-15 10:04:27 -04:00
hid-tmff.c HID: use hid_hw_request() instead of direct call to usbhid 2013-02-25 13:26:41 +01:00
hid-topseed.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-twinhan.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-uclogic.c HID: hid-input: allow input_configured callback return errors 2015-11-05 09:51:50 -08:00
hid-waltop.c HID: Use module_hid_driver macro 2013-01-03 10:27:31 +01:00
hid-wiimote-core.c HID: wiimote: replace hid_output_raw_report with hid_hw_output_report for output requests 2014-02-17 14:57:17 +01:00
hid-wiimote-debug.c HID: wiimote: fix DRM debug-attr to correctly parse input 2013-06-03 11:07:06 +02:00
hid-wiimote-modules.c power_supply: Change ownership from driver to core 2015-03-13 23:15:51 +01:00
hid-wiimote.h power_supply: Change ownership from driver to core 2015-03-13 23:15:51 +01:00
hid-xinmo.c HID: xinmo: fix for out of range for THT 2P arcade controller. 2017-12-25 14:22:12 +01:00
hid-zpff.c HID: zeroplus: validate output report details 2013-09-13 15:11:34 +02:00
hid-zydacron.c HID: trivial devm conversion for special hid drivers 2013-07-31 10:12:28 +02:00
hidraw.c HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device 2018-04-24 09:32:10 +02:00
uhid.c HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges 2018-11-27 16:08:02 +01:00
wacom.h HID: wacom: Add support for Express Key Remote. 2015-08-28 20:43:20 +02:00
wacom_sys.c HID: wacom: Call 'wacom_query_tablet_data' only after 'hid_hw_start' 2015-11-05 11:31:55 +01:00
wacom_wac.c HID: wacom: Correct touch maximum XY of 2nd-gen Intuos 2018-08-24 13:26:57 +02:00
wacom_wac.h Merge branches 'for-4.3/upstream-fixes', 'for-4.4/corsair', 'for-4.4/dragonrise', 'for-4.4/i2c-hid', 'for-4.4/logitech', 'for-4.4/microsoft', 'for-4.4/multitouch', 'for-4.4/roccat-sysfs-deprecation', 'for-4.4/upstream' and 'for-4.4/wacom' into for-linus 2015-11-06 21:45:15 +01:00