Input: fix two kernel stack disclosures via ioctl

[PATCH 0/2] Input: fix two kernel stack disclosures via ioctl

Posted by Iván Ezequiel Rodriguez 3 weeks, 3 days ago

Two places in the input layer copy a user supplied, possibly short
buffer into an uninitialized on-stack structure and then keep the whole
structure, including the part that was never written. In both cases the
stale stack bytes can be read back from userspace.

Patch 1: EVIOCSABS copies min(_IOC_SIZE(cmd), sizeof(struct
input_absinfo)) bytes into an uninitialized struct and stores the result
in dev->absinfo[]. EVIOCGABS returns it. Only the resolution field is
currently cleared for short sizes.

Patch 2: the compat path of input_ff_effect_from_user() aliases the
native struct ff_effect with the smaller struct ff_effect_compat and
copies only the compat sized prefix, leaving the tail untouched.
input_ff_upload() stores the full structure, which a uinput based force
feedback daemon can read back via UI_BEGIN_FF_UPLOAD.

Both are fixed by zeroing the structure before the copy. The patches are
independent of each other.

Compile tested on x86_64 with CONFIG_INPUT_EVDEV, CONFIG_INPUT_UINPUT
and CONFIG_IA32_EMULATION enabled.

Iván Ezequiel Rodriguez (2):
  Input: evdev: zero absinfo before partial copy in EVIOCSABS
  Input: zero ff_effect before compat copy in input_ff_effect_from_user

 drivers/input/evdev.c        | 2 ++
 drivers/input/input-compat.c | 2 ++
 2 files changed, 4 insertions(+)

-- 
2.43.0

Re: [PATCH 0/2] Input: fix two kernel stack disclosures via ioctl

Posted by Dmitry Torokhov 3 weeks, 3 days ago

On Tue, Sep 01, 2026 at 10:06:26AM -0300, Iván Ezequiel Rodriguez wrote:
> Two places in the input layer copy a user supplied, possibly short
> buffer into an uninitialized on-stack structure and then keep the whole
> structure, including the part that was never written. In both cases the
> stale stack bytes can be read back from userspace.
> 
> Patch 1: EVIOCSABS copies min(_IOC_SIZE(cmd), sizeof(struct
> input_absinfo)) bytes into an uninitialized struct and stores the result
> in dev->absinfo[]. EVIOCGABS returns it. Only the resolution field is
> currently cleared for short sizes.
> 
> Patch 2: the compat path of input_ff_effect_from_user() aliases the
> native struct ff_effect with the smaller struct ff_effect_compat and
> copies only the compat sized prefix, leaving the tail untouched.
> input_ff_upload() stores the full structure, which a uinput based force
> feedback daemon can read back via UI_BEGIN_FF_UPLOAD.
> 
> Both are fixed by zeroing the structure before the copy. The patches are
> independent of each other.
> 
> Compile tested on x86_64 with CONFIG_INPUT_EVDEV, CONFIG_INPUT_UINPUT
> and CONFIG_IA32_EMULATION enabled.

Applied the lot, thank you.

-- 
Dmitry