Skip to contentSkip to conversation

Input: potential info leak in uiput_ff_upload_to_user()

PATCH In review Dan Carpenter 2 participants 3 messages Sep 23, 2011

Subsystems (3)
Kernel janitors HID Input drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 Input: potential info leak in uiput_ff_upload_to_user()

Smatch has a new check for Rosenberg type information leaks where structs are copied to the user with uninitialized stack data in them.

The issue here is that struct uinput_ff_upload_compat has a hole in it.

struct uinput_ff_upload_compat {

        int                        request_id;           /*     0     4 */
        int                        retval;               /*     4     4 */
        struct ff_effect_compat    effect;               /*     8     0 */

/* XXX 44 bytes hole, try to pack */

struct ff_effect_compat old; /* 52 0 */

Signed-off-by Dan Carpenter <[email protected]>
drivers/input/misc/uinput.c +2 -0
index 7360568..40e2ba4 100644
@@ -528,6 +528,8 @@ static int uinput_ff_upload_to_user(char __user *buffer,
 	if (INPUT_COMPAT_TEST) {
 		struct uinput_ff_upload_compat ff_up_compat;
 
+		memset(&ff_up_compat, 0, sizeof(ff_up_compat));
+
 		ff_up_compat.request_id = ff_up->request_id;
 		ff_up_compat.retval = ff_up->retval;
 		/*
maintainer
#1 lore raw
Quoted 6 lines · Dan Carpenter

Smatch has a new check for Rosenberg type information leaks where structs are copied to the user with uninitialized stack data in them.

The issue here is that struct uinput_ff_upload_compat has a hole in it.

Quoted 8 lines

struct uinput_ff_upload_compat {

        int                        request_id;           /*     0     4 */
        int                        retval;               /*     4     4 */
        struct ff_effect_compat    effect;               /*     8     0 */

/* XXX 44 bytes hole, try to pack */

struct ff_effect_compat old; /* 52 0 */

44 bytes... doubtful...

Thanks.

Signature · 1 line
Dmitry