Re: [PATCH] Input: uinput/uhid - disallow control characters in phys paths

[Peter Hutterer <peter.hutterer@who-t.net>]

On Fri, Jul 17, 2026 at 05:07:47AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] The patch provides an incomplete mitigation for CVE-2026-50292. It sanitizes the `phys` property to prevent udev property injection via control characters (newlines), but completely fails to sanitize the `name` and `uniq` properties, which are also exported to uevents and controlled by userspace.
> --
> 
> --- Patch [1]: [PATCH] Input: uinput/uhid - disallow control characters in phys paths ---
> commit 1a76e90e7acc09a84a52efddc46e598419020a19
> Author: Peter Hutterer <peter.hutterer@who-t.net>
> 
> Input: uinput/uhid - disallow control characters in phys paths
> 
> This commit sanitizes the phys property in uinput and uhid devices to replace
> control characters with '?'. This prevents userspace from injecting malicious
> udev properties via newlines, which previously triggered CVE-2026-50292.
> 
> > diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
> > index 37b60c3aaf66a..baf1fe8290f75 100644
> > --- a/drivers/hid/uhid.c
> > +++ b/drivers/hid/uhid.c
> > @@ -518,6 +518,7 @@ static int uhid_dev_create2(struct uhid_device *uhid,
> >  	strscpy(hid->name, ev->u.create2.name, sizeof(hid->name));
> >  	BUILD_BUG_ON(sizeof(hid->phys) != sizeof(ev->u.create2.phys));
> >  	strscpy(hid->phys, ev->u.create2.phys, sizeof(hid->phys));
> > +	input_sanitize_phys(hid->phys);
> >  	BUILD_BUG_ON(sizeof(hid->uniq) != sizeof(ev->u.create2.uniq));
> >  	strscpy(hid->uniq, ev->u.create2.uniq, sizeof(hid->uniq));
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but while this successfully mitigates
> CVE-2026-50292 for the phys property, does it still leave the name and uniq
> properties vulnerable?
> 
> In uhid_dev_create2(), the user-controlled ev->u.create2.name and
> ev->u.create2.uniq strings are copied directly without passing through a
> similar sanitization function.
> 
> Additionally, in drivers/input/misc/uinput.c:uinput_dev_setup(), the name
> property is also set without sanitization:
> 
>     dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
> 
> If a user with write access to /dev/uinput or /dev/uhid sets the name or uniq
> properties to strings containing newlines, wouldn't this still allow the
> injection of arbitrary udev environment variables when INPUT_ADD_HOTPLUG_VAR
> formats them for uevents?

name and uniq are controlled by the firmware and thus by the vendor and
control characters (or at least non-ascii) may be legitimately present.
There is no such thing as a sanitized name.

Cheers,
  Peter