usbdev_mmap() creates VMAs which can only be used through usbdev_do_ioctl(), which requires FMODE_WRITE; so usbdev_mmap() is only useful with FMODE_WRITE. On typical Linux systems, files at /dev/bus/usb/*/* are mode 0664, so UIDs without any special privileges can't use usbdev_do_ioctl(), but they can still execute the usbdev_mmap() codepath. Check for FMODE_WRITE in usbdev_mmap() to reduce attack surface a little bit. Signed-off-by: Jann Horn <jannh@xxxxxxxxxx> --- drivers/usb/core/devio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 3beb6a862e80..5363468a282f 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -238,6 +238,9 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) dma_addr_t dma_handle = DMA_MAPPING_ERROR; int ret; + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory)); if (ret) goto error; --- base-commit: eca631b8fe808748d7585059c4307005ca5c5820 change-id: 20241016-usbdev-mmap-require-write-7e56d528d062 -- Jann Horn <jannh@xxxxxxxxxx>
