]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
authorZhen Ni <zhen.ni@easystack.cn>
Sun, 28 Sep 2025 06:37:37 +0000 (14:37 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Oct 2025 09:56:41 +0000 (11:56 +0200)
commit933b87c4590b42500299f00ff55f555903056803
tree82b73cd8042bad7e8d6f6fca146d41396c77e4ba
parent4e04f4444833deeed18ee90a073518d7e1b00cd4
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.

Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.

Initialize ff_up_compat to zero before filling valid fields.

Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/input/misc/uinput.c