From: Gabriel Knezek <redacted>

When userspace requests a GPIO v1 line info changed event, the kernel
populates and returns the gpioline_info_changed structure. That structure
contains 5 words of padding at the end of the structure that are not
initialized before being returned to usermode:

struct gpioline_info_changed {
                struct gpioline_info info;
                __u64 timestamp;
                __u32 event_type;
                __u32 padding[5]; /* for future use */
};

Which is used here in the lineinfo_watch_read routine:
} else {
                struct gpioline_info_changed event_v1;
                gpio_v2_line_info_changed_to_v1(&event, &event_v1);
                if (copy_to_user(buf + bytes_read, &event_v1,
                                                event_size))
                                return -EFAULT;

Fix this by zeroing the structure in gpio_v2_line_info_change_to_v1
before populating its contents.

Signed-off-by: Gabriel Knezek <redacted>
---
 drivers/gpio/gpiolib-cdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index ee5903aac497..af68532835fe 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c

@@ -1865,6 +1865,7 @@ static void gpio_v2_line_info_changed_to_v1(
 		struct gpio_v2_line_info_changed *lic_v2,
 		struct gpioline_info_changed *lic_v1)
 {
+	memset(lic_v1, 0, sizeof(*lic_v1));
 	gpio_v2_line_info_to_v1(&lic_v2->info, &lic_v1->info);
 	lic_v1->timestamp = lic_v2->timestamp_ns;
 	lic_v1->event_type = lic_v2->event_type;

-- 
2.25.1