Re: drivers/s390/char/keyboard.c kernel stack infoleak
From: Thomas Huth
Date: Sat Aug 05 2017 - 03:12:46 EST
On 05.08.2017 03:57, sohu0106 wrote:
> My idea is
>
> struct kbdiacr {
> unsigned char diacr, base, result;
> };
>
> sizeof(struct kbdiacr)=4
>
> here we just set 3 bytes
> case KDGKBDIACR:
> {
> struct kbdiacrs __user *a = argp;
> struct kbdiacr diacr;
> int i;
>
> if (put_user(kbd->accent_table_size, &a->kb_cnt))
> return -EFAULT;
> for (i = 0; i < kbd->accent_table_size; i++) {
> diacr.diacr = kbd->accent_table[i].diacr;
> diacr.base = kbd->accent_table[i].base;
> diacr.result = kbd->accent_table[i].result;
> if (copy_to_user(a->kbdiacr + i, &diacr, sizeof(struct kbdiacr)))
> Is there anything I haven't noticed?
Yes: sizeof(struct kbdiacr) is 3 here.
Thomas