On Thu, Oct 10, 2019 at 06:48:00PM +0200, Ingo Rohloff wrote:
> commit 1455cf8dbfd0 ("driver core: emit uevents when device is bound
> to a driver") added bind and unbind uevents when a driver is bound or
> unbound to a physical device.
> For USB devices which are handled via the generic usbfs layer (via
> libusb for example), this is problematic:
> Each time a user space program calls
>    ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr);
> and then later
>    ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr);
> The kernel will now produce a bind or unbind event, which does not
> really contain any useful information.
> This allows a user space program to run a DoS attack against programs
> which listen to uevents (in particular systemd/eudev/upowerd):
> A malicious user space program just has to call in a tight loop
>    ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr);
>    ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr);
> With this loop the malicious user space program floods the kernel and
> all programs listening to uevents with tons of bind and unbind
> events.
> This patch suppresses uevents for ioctls USBDEVFS_CLAIMINTERFACE and
> Signed-off-by: Ingo Rohloff <ingo.rohl...@lauterbach.com>
> ---
>  drivers/usb/core/devio.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)

I am guessing this is a new version of a previously-submitted patch?  If
so, you need to include a "version" number on it, and put what you
changed below the --- line.  The kernel documentation should explain how
to do this, if not, please let us know.

Please fix this up and resend.


greg k-h

Reply via email to