From nobody Sat Sep 26 12:26:48 2026 Received: from mail-yw1-f180.google.com (mail-yw1-f180.google.com [209.85.128.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9266E3CB574 for ; Tue, 1 Sep 2026 13:06:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788268000; cv=none; b=QSzFOQ5oCpH4Y1Blh5aQ5B4R9zYyqbTxDRZZm5IPOhfk9Mjv1PhSv8TbSXVq4nc/dP/mSqXMw0UMjj3lDyB0BEja79rZzefB9lNXcVRdwejDkL7DBNOWKhGsIzCkVRu2zhQlCZpuq3QXtNVZhzQ+lareJ8Z/0gvH6jEZ7O0rdYY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788268000; c=relaxed/simple; bh=P2zz5GWw5QOn8YaZoIVLc4DNYCylv7L4DbveOHsNUOw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=GX3gWswcw71jGlW9Sztg5/GeFzijwXD70S5nLvLE5bFbA2MdB1llqY6Nf/bFR68csmA8dCNSI6/Jppp1HPkSxbzF0MyGuznuHD5prtacNOVE6+Izo3jjcmYpLdSCMDchFOBwPG4P5NarWXBy2mvIK1Geqjz9KqUH9plxpu1usNs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jXXf+Jb9; arc=none smtp.client-ip=209.85.128.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jXXf+Jb9" Received: by mail-yw1-f180.google.com with SMTP id 00721157ae682-85aeb506b78so63514387b3.3 for ; Tue, 01 Sep 2026 06:06:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788267997; x=1788872797; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=5yfDIPBjmDhoPL2UJgt15HMxvXWs2DkCFmbgzNrEbnE=; b=jXXf+Jb9w2nG0z9AsmUV9dAvDyjXOKrAcjzL7xBAmHTOdwUZBrXwNwVw2ynJ5wRFkc J6/G7TCGLbS7KiGh+ouqNFGYbWqiOqMfQwXOvs04CoHOnYLS5yWVw35pIRzrB+sxpGY+ 5KFX22I16wAi97gkfM8aC5VGPRe2WIJt7Blw0eT83OtMwt+B4ciYce+BZQUvbwjkFHJ8 5DCG6BLxSRFWE2WWP2/l8kVznLTZclvExZntdQSL9EpBM8+k8t8F+bPPnMFsJakMjS3B YkwtfdZHMdGp5e/8GgRR17xz5v535hhT40VS3i8pvaf8MlluUSLb+BgZaQcM/y0UnNb2 7Z+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788267997; x=1788872797; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5yfDIPBjmDhoPL2UJgt15HMxvXWs2DkCFmbgzNrEbnE=; b=gFU0v4lpjkVxKL+eo5LULZKHyTqagjSkp+v4rHP2UIim/mjgQvKOpQrwcubVYrCb54 ArM073H05f3shCNGGIacomec85Yeszte3f+L257Lz6bHcxepWxq5n584QNOWU452UyRT AeYsoGbBjZCWXZVn9GnmbToIuSP0wedAzBBmtVMWpueuK9OkT7QzHOsVPRyIvmbWfKOA +KXaXxmLT/BNUwcrsDBcSiE1fsiaGwaq3QEZ0YsAxBuJdAY/PpsIAcNU/v1Qynv+r0rq YgpAAL1lgBGT3tHzooWl8IlSeAwsUJBaX4dD2nl4Fg24/XtzEK9MVvndLayhNb+JtlwK 0IIw== X-Forwarded-Encrypted: i=1; AKwUvBwWmWM459Zd35NW3ypca8VGGfC0N5Fw686L/X56cWQG+uVJcSjJij+ml1TW6jVngQr5mOSxgGd0fQNINq8=@vger.kernel.org X-Gm-Message-State: AFuF++nhacp3uxmfD0isXEXnpM5LgI1ZRp7Ejgqu+2eA3sHEiSrFrDKs 4QFLPLJM+wtUS5vyuWujLWmA8wP44MP2hWA2h+FE8a6gzQUSVSD/ZqUL7CnGg8O6cuU= X-Gm-Gg: AYBFou3MxZfFwk6Nl6F9XVrKda8vTDxLs9KfLqtEnwH6sSZuJfi0gg6gCqND2+Vis2s oFRCDKgV52Ini2qsukOEj82i5osHkrE+UfmAr3IRAC+dc3rT3WlPgqBUfm8eS1ocD13DCHo3/QL Ukkv7cgr1LrtkKUg/b2kbo704g3Ez11EVrVn57hHrYPRk1iHYa8YSCwq5jPgIK3kNFf/F7wBNCT bd2yMsJKwe3jI/Fl8CDg9yQyyA1O3GHktAGLR/apDJwzZtyZk69RrcVEdPkrVNjvrVqAOrq2Mli QtKqsS2UC/vSbNtGmS0pLIdtnzvMZv0AK2TaeVDbN/j8qWj4uNSYCJNydaKm0ONuMWmPHCdRQ1y 6DzlHnZubn0hDgzJRwdRVtgohQLL6wUwPN+S0ZxonStln2evJCpH2JocczuAVHieuTBQN8qZhT5 DoJvDgH4dD5qVVRg8j26Ee47dYsRRGaJU+emqwvS5s1hrirhnl6K3D87qSq85irDbz X-Received: by 2002:a05:690c:e3c4:b0:814:7a54:3a93 with SMTP id 00721157ae682-86873382f72mr35758917b3.23.1788267997408; Tue, 01 Sep 2026 06:06:37 -0700 (PDT) Received: from unix.. ([181.229.23.179]) by smtp.gmail.com with ESMTPSA id 00721157ae682-85e5ed1cd5bsm73290547b3.17.2026.09.01.06.06.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 06:06:36 -0700 (PDT) From: =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= Subject: [PATCH 1/2] Input: evdev: zero absinfo before partial copy in EVIOCSABS Date: Tue, 1 Sep 2026 10:06:27 -0300 Message-ID: <20260901130629.24078-2-ivanrwcm25@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901130629.24078-1-ivanrwcm25@gmail.com> References: <20260901130629.24078-1-ivanrwcm25@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct input_absinfo: if (copy_from_user(&abs, p, min_t(size_t, size, sizeof(struct input_absinfo)))) The size comes from _IOC_SIZE() of the ioctl command and is therefore fully controlled by userspace. A short size leaves the trailing part of the structure holding whatever was on the kernel stack, and the whole structure is then stored into the device: dev->absinfo[t] =3D abs; EVIOCGABS hands that back to userspace, disclosing the stale stack bytes. Only the resolution field is currently cleared, which covers the legacy struct layout but not an arbitrarily short size. Zero the structure before the copy so any part not supplied by the caller reads back as zero. The existing resolution fixup is kept, since it also handles a size that partially overlaps that field. Fixes: 448cd1664a57 ("Input: evdev - rearrange ioctl handling") Cc: stable@vger.kernel.org Signed-off-by: Iv=C3=A1n Ezequiel Rodriguez --- drivers/input/evdev.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c index 3a718d600006..8bfaaa45e0b9 100644 --- a/drivers/input/evdev.c +++ b/drivers/input/evdev.c @@ -1229,6 +1229,8 @@ static long evdev_do_ioctl(struct file *file, unsigne= d int cmd, =20 t =3D _IOC_NR(cmd) & ABS_MAX; =20 + memset(&abs, 0, sizeof(abs)); + if (copy_from_user(&abs, p, min_t(size_t, size, sizeof(struct input_absinfo)))) return -EFAULT; --=20 2.43.0 From nobody Sat Sep 26 12:26:48 2026 Received: from mail-yw1-f182.google.com (mail-yw1-f182.google.com [209.85.128.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 264124052AC for ; Tue, 1 Sep 2026 13:06:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788268002; cv=none; b=fYb1BTXhd9ezZoayn9cWnzvOrKGMGPAO4x8V5BMPEdaZBgGGR1iOvWVxGTrJwiO+LyiI1mvaWrhqetRZKe3gmB6RdMDhJDfgPZksOqj8OnSMdXxg0wdLcn3QL0cTKmk9U3yOo8RB5u8tDoN8HuJgnY/Qr0RqIySYjACBSjkeFPU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788268002; c=relaxed/simple; bh=8oafQKn5E1afmjR0jBaThKt8NuujDHb/1wpNQn0jknc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ByYiR7P8Ue6JaPUBdmsDoSScFc+PeFLuxBcF1CDm/G6oEwXwDx1cwJNhhzEyLAaOS3kF+TwQNvSCGGKJUQsGMP4rR1TvYV4Zr9xue7o+mKBrBj5RYN73tBk1DMu8yqO4YMos9c/c/Qwg9PoFNSuN9ySEHOVz/IjwzZnKai73Fws= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=R6Btcb3b; arc=none smtp.client-ip=209.85.128.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="R6Btcb3b" Received: by mail-yw1-f182.google.com with SMTP id 00721157ae682-8565d77c277so45888877b3.0 for ; Tue, 01 Sep 2026 06:06:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788268000; x=1788872800; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=o7XTCNgZ64MJCC1OTIr3HJaK9bEsF0FVXR7920AQRVk=; b=R6Btcb3brXw0ZKyH1xCJstdChuCpgMpeYfUIsBtKfGAR7lkq5AQ/CeYmxfwmTsOLtn DDzUZvH95Jik2Kk1/VsnuWNSLvZDx1jUfhI9PUXfqagtgBHxkxv4WE65xxZoqXJZnTzM BNGuyx4QOHNUPLbjJaq3EnshgS4maAQhID4hzwXrYaPyxh6KxR/1rXhiuRvReioaZU6H rfqJ386QyyT85P02c5suurWspHRq0BtZYvEbvR3QGQt9yE4BExmbHkZS+UyUsxDNmzKC l5qKc6tOIDF/tX31HyqbePEjCmcarbc0lnnjqODh6G+Pv/i2gQ1/s6USKxtcwqhcxpQT A2Yg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788268000; x=1788872800; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=o7XTCNgZ64MJCC1OTIr3HJaK9bEsF0FVXR7920AQRVk=; b=Hmb2hyN69cgmajA+o0dXc8pf7q8JEsd2IC7NZS4jBxNJ5hNVFoIJyFVyz6JKaBjmME DAACU1AsJDMB7sxhiZW1febwpYRoLFB6kJ7XzbSKZXv2m96OG2o7c3dW8Xd4lk7kDK8n Yofe3wsXnjrDaIh/z9ZLinfl7UVvonJI3/nRJG2IHut88oQP0MAmNqTw8oiVqXRM/Jle mh9J3UBNDwekwyPZnqVFpMQjuBCeLfTXa2lPlFhaE7cCB/iElG4MVenvf3O1UxOD4oEp XjYR7IoBLr2t67yKTTpuJVr1u6ssrGnJCiVqmbEAm5QkT97a8gseUbTOWdght3YEgg/x 6GpQ== X-Forwarded-Encrypted: i=1; AKwUvByW5WKxiHOQW8NmAwvZhNTUpxOKKO/JTLImzIo7aIQ4bN41n55K0kOyuhx8gAHZngrlyh/TJd3TFIdaVvE=@vger.kernel.org X-Gm-Message-State: AFuF++l/ctt+3pZ5rNz5gRSH+zJua721FZFtx/jnAd/MmdtlfgZhkCq0 Xpf9DmhAWhQShWTW8q4a5tTXBQE49nfcdLL7VArtDtsfs7uzir5s1E1i X-Gm-Gg: AYBFou30aTvoyyb4Ty9zSgQkYfCs175N/lxigpEbcPuaxxATHJVTyx9IoCqTcNvmAhu 4uA0+ROWcJU2SKNpcTqe0eeXMHxBnvy4x+hIMwQQoA13BgdXDDQAXWyqIcaDnltvRuMh9xPAGL0 0da3Zt7er4B1ZQZyOP+51gePJVy6spF1hqzGFX+iQm0PIuwrR1NXWplTs14beFBeZarea7TXRH2 vIAkE9Qe+FRukezghHRqOYcpN9NOmWGeB2b0eSPf2EPso2xyMVb7c9e9mhrZCByldaUz9JffRW0 NLc30Ig9DxxrCZt5xDR3MxQEw/3ZKjMnRm7fVGKUoEptiG6NrTmpl6B7nZvdTcT/laY4XrtceZE yxDyx32kVgP3Iy5j7NotQG76BRd686PbSxUxA1n6PgFdw/pxG+b1s7QUcYodem9SxnIv17FpzJi ytPruRtpbQjHEejA/H8t6lG8kHvlVs3/f3U73LkwjJQyKVCDJPwlTSdhfz1xydGolQ X-Received: by 2002:a05:690c:4005:b0:856:98e2:6e9b with SMTP id 00721157ae682-85d69640f36mr102875907b3.5.1788267999872; Tue, 01 Sep 2026 06:06:39 -0700 (PDT) Received: from unix.. ([181.229.23.179]) by smtp.gmail.com with ESMTPSA id 00721157ae682-85e5ed1cd5bsm73290547b3.17.2026.09.01.06.06.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 06:06:39 -0700 (PDT) From: =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, =?UTF-8?q?Iv=C3=A1n=20Ezequiel=20Rodriguez?= Subject: [PATCH 2/2] Input: zero ff_effect before compat copy in input_ff_effect_from_user Date: Tue, 1 Sep 2026 10:06:28 -0300 Message-ID: <20260901130629.24078-3-ivanrwcm25@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901130629.24078-1-ivanrwcm25@gmail.com> References: <20260901130629.24078-1-ivanrwcm25@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In the compat path input_ff_effect_from_user() aliases the caller's native struct ff_effect with the smaller struct ff_effect_compat and copies only the compat sized prefix: compat_effect =3D (struct ff_effect_compat *)effect; if (copy_from_user(compat_effect, buffer, sizeof(struct ff_effect_compat))) The tail of the native structure is never written. Callers pass an uninitialized on-stack object, for example evdev_do_ioctl() for EVIOCSFF, so those bytes keep their previous stack contents. input_ff_upload() then stores the full native structure in ff->effects[id], from where a uinput based force feedback daemon can read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to userspace. Zero the effect before the compat copy. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable wi= th uinput") Cc: stable@vger.kernel.org Signed-off-by: Iv=C3=A1n Ezequiel Rodriguez --- drivers/input/input-compat.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/input/input-compat.c b/drivers/input/input-compat.c index a5043193ead8..8860a0730294 100644 --- a/drivers/input/input-compat.c +++ b/drivers/input/input-compat.c @@ -76,6 +76,8 @@ int input_ff_effect_from_user(const char __user *buffer, = size_t size, */ compat_effect =3D (struct ff_effect_compat *)effect; =20 + memset(effect, 0, sizeof(*effect)); + if (copy_from_user(compat_effect, buffer, sizeof(struct ff_effect_compat))) return -EFAULT; --=20 2.43.0