HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges

When a UHID_CREATE command is written to the uhid char device, a
copy_from_user() is done from a user pointer embedded in the command.
When the address limit is KERNEL_DS, e.g. as is the case during
sys_sendfile(), this can read from kernel memory.  Alternatively,
information can be leaked from a setuid binary that is tricked to write
to the file descriptor.  Therefore, forbid UHID_CREATE in these cases.

No other commands in uhid_char_write() are affected by this bug and
UHID_CREATE is marked as "obsolete", so apply the restriction to
UHID_CREATE only rather than to uhid_char_write() entirely.

Thanks to Dmitry Vyukov for adding uhid definitions to syzkaller and to
Jann Horn for commit 9da3f2b740544 ("x86/fault: BUG() when uaccess
helpers fault on kernel addresses"), allowing this bug to be found.

Reported-by: [email protected]
Fixes: d365c6cfd337 ("HID: uhid: add UHID_CREATE and UHID_DESTROY events")
Cc: <[email protected]> # v3.6+
Cc: Jann Horn <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Signed-off-by: Eric Biggers <[email protected]>
Reviewed-by: Jann Horn <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>

0 files changed, 0 insertions, 0 deletions