From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 13 Aug 2026 12:25:05 +0000 (+0900)
Subject: 6.12-stable patches
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fdaa2322f6447cffba255045c6b04fbbef36e6e5;p=thirdparty%2Fkernel%2Fstable-queue.git

6.12-stable patches

added patches:
	input-evdev-fix-information-leak-in-evdev_pass_values.patch
---

diff --git a/queue-6.12/input-evdev-fix-information-leak-in-evdev_pass_values.patch b/queue-6.12/input-evdev-fix-information-leak-in-evdev_pass_values.patch
new file mode 100644
index 0000000000..ad9b9ba85c
--- /dev/null
+++ b/queue-6.12/input-evdev-fix-information-leak-in-evdev_pass_values.patch
@@ -0,0 +1,88 @@
+From 90f305f2c7a30257c683e13f4bf7c798eea992a0 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 29 Jul 2026 11:30:45 -0700
+Subject: Input: evdev - fix information leak in evdev_pass_values()
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 90f305f2c7a30257c683e13f4bf7c798eea992a0 upstream.
+
+In evdev_pass_values(), the input_event structure is allocated on the
+kernel stack and populated field-by-field. However, it is never fully
+initialized. On architectures where struct input_event contains explicit
+or implicit padding (such as the 32-bit __pad field on SPARC64), these
+padding bytes are left uninitialized.
+
+When this event structure is subsequently passed to the client buffer
+and later copied to userspace, the uninitialized padding bytes leak
+kernel stack memory, potentially exposing sensitive information.
+
+Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
+
+Fix this by explicitly zeroing the entire event structure with memset()
+before populating its fields. This ensures all padding bytes are cleared
+before the data crosses the security boundary.
+
+Reported-by: sashiko-bot@kernel.org
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/ampGGKo4UMKru6f5@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/evdev.c |   22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -149,11 +149,11 @@ static void __evdev_queue_syn_dropped(st
+ 	struct timespec64 ts = ktime_to_timespec64(ev_time[client->clk_type]);
+ 	struct input_event ev;
+ 
++	memset(&ev, 0, sizeof(ev));
+ 	ev.input_event_sec = ts.tv_sec;
+ 	ev.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
+ 	ev.type = EV_SYN;
+ 	ev.code = SYN_DROPPED;
+-	ev.value = 0;
+ 
+ 	client->buffer[client->head++] = ev;
+ 	client->head &= client->bufsize - 1;
+@@ -221,20 +221,20 @@ static void __pass_event(struct evdev_cl
+ 	client->head &= client->bufsize - 1;
+ 
+ 	if (unlikely(client->head == client->tail)) {
++		struct input_event ev;
++
++		memset(&ev, 0, sizeof(ev));
++		ev.input_event_sec = event->input_event_sec;
++		ev.input_event_usec = event->input_event_usec;
++		ev.type = EV_SYN;
++		ev.code = SYN_DROPPED;
++
+ 		/*
+ 		 * This effectively "drops" all unconsumed events, leaving
+ 		 * EV_SYN/SYN_DROPPED plus the newest event in the queue.
+ 		 */
+ 		client->tail = (client->head - 2) & (client->bufsize - 1);
+-
+-		client->buffer[client->tail] = (struct input_event) {
+-			.input_event_sec = event->input_event_sec,
+-			.input_event_usec = event->input_event_usec,
+-			.type = EV_SYN,
+-			.code = SYN_DROPPED,
+-			.value = 0,
+-		};
+-
++		client->buffer[client->tail] = ev;
+ 		client->packet_head = client->tail;
+ 	}
+ 
+@@ -256,6 +256,8 @@ static void evdev_pass_values(struct evd
+ 	if (client->revoked)
+ 		return;
+ 
++	memset(&event, 0, sizeof(event));
++
+ 	ts = ktime_to_timespec64(ev_time[client->clk_type]);
+ 	event.input_event_sec = ts.tv_sec;
+ 	event.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
diff --git a/queue-6.12/series b/queue-6.12/series
index 6af34c8aac..93a67f442c 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -81,3 +81,4 @@ net-usb-ax88179_178a-fix-skb-leak-in-ax88179_tx_fixup.patch
 net-usb-ipheth-fix-carrier_work-uaf-on-disconnect.patch
 vt-add-permission-check-for-kdskbmeta-ioctl.patch
 vt-stabilize-tty-reference-in-kbd_keycode-with-tty_port_tty_get.patch
+input-evdev-fix-information-leak-in-evdev_pass_values.patch