On Sun, Sep 28, 2025 at 02:37:37PM +0800, Zhen Ni wrote:
Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
Nicely spotted, thank you, applied.