diff options
| author | Zhen Ni <zhen.ni@easystack.cn> | 2025-09-28 14:37:37 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-15 11:56:41 +0200 |
| commit | 933b87c4590b42500299f00ff55f555903056803 (patch) | |
| tree | 82b73cd8042bad7e8d6f6fca146d41396c77e4ba | |
| parent | 4e04f4444833deeed18ee90a073518d7e1b00cd4 (diff) | |
| download | linux-933b87c4590b42500299f00ff55f555903056803.tar.gz linux-933b87c4590b42500299f00ff55f555903056803.tar.bz2 linux-933b87c4590b42500299f00ff55f555903056803.zip | |
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.
Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/input/misc/uinput.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 790db3ceb208..faed4590a8a9 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -741,6 +741,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, if (in_compat_syscall()) { struct uinput_ff_upload_compat ff_up_compat; + memset(&ff_up_compat, 0, sizeof(ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval; /* |