Input: fix two kernel stack disclosures via ioctl

Two places in the input layer copy a user supplied, possibly short buffer into an uninitialized on-stack structure and then keep the whole structure, including the part that was never written. In both cases the stale stack bytes can be read back from userspace.

Patch 1: EVIOCSABS copies min(_IOC_SIZE(cmd), sizeof(struct input_absinfo)) bytes into an uninitialized struct and stores the result in dev->absinfo[]. EVIOCGABS returns it. Only the resolution field is currently cleared for short sizes.

Patch 2: the compat path of input_ff_effect_from_user() aliases the native struct ff_effect with the smaller struct ff_effect_compat and copies only the compat sized prefix, leaving the tail untouched. input_ff_upload() stores the full structure, which a uinput based force feedback daemon can read back via UI_BEGIN_FF_UPLOAD.

Both are fixed by zeroing the structure before the copy. The patches are independent of each other.

Compile tested on x86_64 with CONFIG_INPUT_EVDEV, CONFIG_INPUT_UINPUT and CONFIG_IA32_EMULATION enabled.

Iván Ezequiel Rodriguez (2):
Input: evdev: zero absinfo before partial copy in EVIOCSABS
Input: zero ff_effect before compat copy in input_ff_effect_from_user

 drivers/input/evdev.c        | 2 ++
 drivers/input/input-compat.c | 2 ++
 2 files changed, 4 insertions(+)

2.43.0