Re: drivers/s390/char/keyboard.c kernel stack infoleak

From	Thomas Huth <huth@tuxfamily.org>
Newsgroups	linux.kernel
Subject	Re: drivers/s390/char/keyboard.c kernel stack infoleak
Date	2017-08-05 09:20 +0200
Message-ID	<ub1xo-1Ae-7@gated-at.bofh.it> (permalink)
References	<uaoPn-Jx-15@gated-at.bofh.it> <uaGMi-53u-25@gated-at.bofh.it> <uaH5D-5ax-11@gated-at.bofh.it> <ub1xo-1Ae-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 05.08.2017 03:57, sohu0106 wrote:
> My idea is 
> 
> struct kbdiacr {
>         unsigned char diacr, base, result;
> };
> 
> sizeof(struct kbdiacr)=4  
> 
> here we just set 3 bytes 
> case KDGKBDIACR:
> {
> struct kbdiacrs __user *a = argp;
> struct kbdiacr diacr;
> int i;
> 
> if (put_user(kbd->accent_table_size, &a->kb_cnt))
> return -EFAULT;
> for (i = 0; i < kbd->accent_table_size; i++) {
> diacr.diacr = kbd->accent_table[i].diacr;
> diacr.base = kbd->accent_table[i].base;
> diacr.result = kbd->accent_table[i].result;
> if (copy_to_user(a->kbdiacr + i, &diacr, sizeof(struct kbdiacr)))
> Is there anything I haven't noticed?

Yes: sizeof(struct kbdiacr) is 3 here.

 Thomas

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

drivers/s390/char/keyboard.c kernel stack infoleak sohu0106 <sohu0106@126.com> - 2017-08-03 16:00 +0200
  Re: drivers/s390/char/keyboard.c kernel stack infoleak Thomas Huth <huth@tuxfamily.org> - 2017-08-04 11:10 +0200
    Re: drivers/s390/char/keyboard.c kernel stack infoleak Heiko Carstens <heiko.carstens@de.ibm.com> - 2017-08-04 11:30 +0200
      Re: drivers/s390/char/keyboard.c kernel stack infoleak Thomas Huth <huth@tuxfamily.org> - 2017-08-05 09:20 +0200

csiph-web