fsg_lun_open() takes any regular file as the backing file of a LUN. The file-storage kthread then reads and writes it with kernel_read() and kernel_write() on behalf of the USB host. With a procfs or sysfs file behind a LUN the host gets to read and write kernel interfaces with kernel credentials. Refuse files on pseudo filesystems just like loop does.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/usb/gadget/function/storage_common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c index 75831f2c7abe..83683ade20c2 100644 --- a/drivers/usb/gadget/function/storage_common.c +++ b/drivers/usb/gadget/function/storage_common.c @@ -211,6 +211,11 @@ int fsg_lun_open(struct fsg_lun *curlun, const char *filename) goto out; } + if (file_is_pseudo(filp)) { + LINFO(curlun, "file on a pseudo filesystem: %s\n", filename); + goto out; + } + /* * If we can't read the file, it's no good. * If we can't write the file, use it read-only. -- 2.53.0
