⬢ DragonFlyBSD Kernel Audit
DF-5316 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
--- a/sys/bus/u4b/usb_generic.c
+++ b/sys/bus/u4b/usb_generic.c
@@ -604,8 +604,20 @@
 static int
 ugen_set_config(struct usb_fifo *f, uint8_t index)
 {
+	int error;
+
 	DPRINTFN(2, "index %u\n", index);
 
+	/*
+	 * DF-5316: changing the device configuration detaches drivers
+	 * and re-enumerates the device; require the same privilege that
+	 * ugen_check_request() demands for the raw UR_SET_CONFIG
+	 * control request.
+	 */
+	error = caps_priv_check_self(SYSCAP_NODRIVER);
+	if (error)
+		return (error);
+
 	if (f->udev->flags.usb_mode != USB_MODE_HOST) {
 		/* not possible in device side mode */
 		return (ENOTTY);
@@ -628,8 +640,18 @@
 ugen_set_interface(struct usb_fifo *f,
     uint8_t iface_index, uint8_t alt_index)
 {
+	int error;
+
 	DPRINTFN(2, "%u, %u\n", iface_index, alt_index);
 
+	/*
+	 * DF-5316: same gate as ugen_check_request() applies to the raw
+	 * UR_SET_INTERFACE control request.
+	 */
+	error = caps_priv_check_self(SYSCAP_NODRIVER);
+	if (error)
+		return (error);
+
 	if (f->udev->flags.usb_mode != USB_MODE_HOST) {
 		/* not possible in device side mode */
 		return (ENOTTY);